Preservation of electronic messages between snapshots

ABSTRACT

Methods and systems for improving data back-up, recovery, and search across different cloud-based applications, services, and platforms are described. A data management and storage system may direct compute and storage resources within a customer&#39;s cloud-based data storage account to back-up and restore data while the customer retains full control of their data. The data management and storage system may direct the compute and storage resources within the customer&#39;s cloud-based data storage account to generate and store secondary layers that are used for generating search indexes, to generate and store shared space layers and user specific layers to facilitate the deduplication of email attachments and text blocks, to perform a controlled restoration of email snapshots such that sensitive information (e.g., restricted keywords) located within stored snapshots remains protected, and to detect and preserve emails that were received or transmitted and then deleted between two consecutive snapshots.

BACKGROUND

Virtualization allows virtual hardware to be created and decoupled fromthe underlying physical hardware. For example, a hypervisor running on ahost machine or server may be used to create one or more virtualmachines that may each run the same operating system or differentoperating systems (e.g., a first virtual machine may run a Windows®operating system and a second virtual machine may run a Unix-likeoperating system such as OS X®). A virtual machine may comprise asoftware implementation of a physical machine. The virtual machine mayinclude one or more virtual hardware devices, such as a virtualprocessor, a virtual memory, a virtual disk, or a virtual networkinterface card. The virtual machine may load and execute an operatingsystem and applications from the virtual memory. The operating systemand applications executed by the virtual machine may be stored using thevirtual disk. The virtual machine may be stored (e.g., using a datastorecomprising one or more physical storage devices) as a set of filesincluding a virtual disk file for storing the contents of the virtualdisk and a virtual machine configuration file for storing configurationsettings for the virtual machine. The configuration settings may includethe number of virtual processors (e.g., four virtual CPUs), the size ofa virtual memory, and the size of a virtual disk (e.g., a 2 TB virtualdisk) for the virtual machine.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A depicts one embodiment of a networked computing environment.

FIG. 1B depicts one embodiment of a server.

FIG. 1C depicts one embodiment of a storage appliance.

FIG. 1D depicts one embodiment of a portion of an integrated datamanagement and storage system that includes a plurality of nodes incommunication with each other and one or more storage devices.

FIGS. 2A-2K depict various embodiments of sets of files and datastructures associated with managing and storing snapshots of virtualmachines.

FIG. 3A is a flowchart describing one embodiment of a process formanaging and storing virtual machine snapshots using a data storagesystem.

FIG. 3B is a flowchart describing one embodiment of a process fordetermining the type of snapshot to be stored using a data storagesystem.

FIG. 3C is a flowchart describing one embodiment of a process forrestoring a version of a virtual machine using a data storage system.

FIGS. 4A-4B depict various embodiments of a cloud computing environmentthat includes a customer cloud service and a customer cloud storage.

FIGS. 4C-4D depict a flowchart describing one embodiment of a processfor orchestrating the capturing and storing of snapshots of a set ofdata from a cloud-based service controlled by a customer to acloud-based storage service controlled by the customer.

FIGS. 5A-5D depict various embodiment of point in time snapshots of aset of data and corresponding secondary layers and search indexes forthe snapshots.

FIG. 5E is a flowchart describing one embodiment of a process forgenerating and storing secondary layers corresponding with snapshots ofa set of data.

FIG. 6A depicts one embodiment of a multi-layered approach for storingsnapshots of a set of data.

FIG. 6B depicts one embodiment of a multi-layered approach fordeduplicating content.

FIG. 6C depicts one embodiment of the state of the shared space layerand the user specific layers depicted in FIG. 6A in which a restoreoperation is performed to restore electronic messages corresponding withdifferent user specific layers.

FIG. 6D depicts one embodiment of a secondary layer generated from ashared space layer and a search index.

FIGS. 6E-6F depict a flowchart describing one embodiment of a processfor deduplicating content using a shared space layer and one or moreuser specific layers that contain pointers into the shared space layer.

FIG. 6G is a flowchart describing one embodiment of a process forselectively restoring content from a shared space layer that isreferenced by one or more user specific layers corresponding withindividual electronic messages.

FIG. 7A depicts one embodiment of two consecutive snapshots of a set ofelectronic messages and electronic messages that were a part of the setof electronic files between the two consecutive snapshots but were notcaptured by the either of the two consecutive snapshots.

FIG. 7B is a flowchart describing one embodiment of a process foridentifying electronic messages that were not captured by twoconsecutive snapshots of a set of electronic messages and generating abuffer snapshot for the missing electronic messages.

DETAILED DESCRIPTION

Technology is described for providing a data management and storagesystem to backup, archive, recover, and search data across differentcloud-based applications, services, and platforms. A cloud-basedapplication, service, or platform may correspond with a cloud-basedsoftware-as-a-service (SaaS), which may refer to a software distributionmodel in which applications are hosted by a service provider and madeavailable to end users over the Internet. The cloud-based application,service, or platform may provide a work productivity application (e.g.,a word processing application or a spreadsheet application), acommunication application (e.g., an instant messaging application), or afile sharing and synchronization application over the Internet. Onetechnical issue with relying on different cloud-based applications,services, and platforms is that data may be lost due to an end usererror (e.g., the end user may accidentally delete valuable data withoutrealizing the mistake until after several weeks have passed) if thenative platform on which the end user error occurred does not provide afine-granularity capability to backup and restore end user data. Onetechnical benefit of providing a data management and storage system tobackup end user data across different cloud-based applications,services, and platforms is that the end user data may be protected fromdata loss via fine-granularity backups (e.g., snapshots of the end userdata may be captured and stored on an hourly basis or every fiveminutes) and the end user data may be recovered quickly in the event ofdata loss with fine-granularity search and restores. For example, in theevent of data loss due to an end user error, the end user may be able toquickly search through different point in time snapshots of anelectronic mailbox by email address, date range, and keywords withinsubject lines in order to select and restore a point in time version ofthe electronic mailbox, a calendar, or a group of electronic messages.Another technical benefit of providing the data management and storagesystem is that an aggregated search may be performed across thedifferent cloud-based applications, services, and platforms.

In some embodiments, the data management and storage system may comprisea cloud-based data management application that is in communication withan end user's (or customer's) cloud-based data storage service that iscontrolled and/or owned by the end user (or customer). The end user mayexclusively set or control the data retention policies within theircloud-based data storage service and control the transfer of data fromother cloud-based services that are also controlled by the end user totheir cloud-based data storage service. In the case of point in timesnapshots of data (e.g., snapshots of a user's email mailbox) beingcaptured from the cloud-based service and stored within cloud-based datastorage service, the machines and services transferring the snapshotdata are all within accounts or services controlled by the end user. Inone example, the cloud-based data storage service may comprise a securecloud-based data storage service (e.g., Azure or S3) and the othercloud-based services may include a cloud-based subscription service(e.g., Office 365) or a cloud-based file service (e.g., OneDrive). Theend user may allow the data management and storage system to establish asecure connection with the cloud-based data storage service (e.g., viatoken-based authentication) and to transfer or create an applicationwith restricted access to compute and storage resources within thecloud-based data storage service. Thereafter, the data management andstorage system may then orchestrate or provide limited instructions tothe application with restricted access to the compute and storageresources in order to perform data management tasks for the cloud-baseddata storage service, such as data management tasks to backup, search,or recover data within the cloud-based data storage service.

The data management and storage system in communication with the enduser's cloud-based data storage service may comprise a hardware storageappliance that includes hardware data storage nodes or a virtual storageappliance that includes virtual data storage nodes. The data managementand storage system may monitor and control compute resources external tothe data management and storage system that are within the end user'scloud-based data storage service (e.g., monitoring the amount of computeand storage resources available to generate and store search indexeswithin the end user's cloud-based data storage account) to back-up theend user's data while the end user retains full control of their data.The data management and storage system may be granted access permissionsto access a compute resource group within the end user's cloud-baseddata storage account to allow the data management and storage system torun applications or application containers using the compute resourcegroup, to adjust the amount of compute and/or storage resources requiredto run the applications or application containers, and to access blobstorage and block storage to store data backups and search indexes forthe data backups.

In one embodiment, the amount of memory and compute resources within theend user's cloud-based data storage account may vary over time (e.g.,adjusted by the end user in order to reduce storage costs or to takeadvantage of compute elasticity) and in response the data management andstorage system may make adjustments, such as generating smaller-sizedsecondary layers that are stored and indexed within the end user'scloud-based data storage account. A secondary layer may comprise aportion of a snapshot from which a search index may be generated. In oneexample, the secondary layer for a snapshot of a plurality of electronicmessages (e.g., emails) may comprise extracted portions of the pluralityof electronic messages comprising only the subject, sender, and receiverfields for the plurality of electronic messages. The files sizes of thesecondary layers and the number of search indexes generated and storedwithin the end user's cloud-based data storage account may beautomatically scaled over time with the amount of memory and computeresources that are available to the data management and storage systemwithin the end user's cloud-based data storage account.

In some embodiments, the data management and storage system may directthe resources within the end user's cloud-based data storage service togenerate and store secondary layers that are used for generating searchindexes for snapshots stored using the storage resources. In this case,a secondary layer may be generated for each snapshot and include onlyextracted portions of the snapshot. The snapshots may comprise snapshotsof virtual machines, snapshots of real machines, or snapshots of auser's email inbox over time. Generating search indexes for older pointin time versions of a user's email inbox may allow the user to searchemails that are no longer in their current inbox. In one example, if asnapshot comprises a snapshot of the electronic messages within a user'semail inbox at a particular point in time, then the secondary layer maycomprise the portions of the electronic messages corresponding with theto, carbon copy, from, and subject fields of each electronic message andthe first ten lines of text within the message body of each electronicmessage. Instead of indexing an entire snapshot, a search index may begenerated for just the secondary layer. For the electronic messageswithin the user's email inbox at the particular point in time, both thecomplete data corresponding with the point in time snapshot of theuser's email inbox, which may be stored as a full or incrementalsnapshot, and the secondary layer that comprises a subset of the data tobe indexed may be stored. The secondary layer may be stored using blockstorage or file-based storage while the full or incremental snapshot isstored using blob storage. In some cases, the secondary layer may bestored using hot cloud data storage while the full or incrementalsnapshot is stored using cold cloud data storage. The size of thesecondary layer may be adjusted over time based on update frequency,prior user behavior (e.g., which folders, subjects, usernames, and dateranges are frequently searched on), and the availability of storageresources within the customer's data storage account that may changeover time. The secondary layers may be deleted to save space orregenerated over time (e.g., a secondary layer may be enlarged if a userstarts to heavily search a particular range of dates).

In some embodiments, the data management and storage system may directthe resources within the end user's cloud-based data storage service togenerate and store shared space layers and user specific layers tofacilitate the deduplication of email attachments and facilitate thecontrolled restoration of portions of email messages such that sensitiveinformation remains protected and is not restored to unauthorized users.A snapshot of a plurality of electronic messages associated with auser's email mailbox may be stored using a shared space layer thatcomprises attachments and large blocks of common text and a userspecific layer that comprises the user's email with pointers into theshared space layer. If an email (or electronic message) is sent to tenemail addresses with a large attachment, then the shared space layer maystore a single copy of the large attachment if the disk space for thelarge attachment is greater than a threshold amount of disk space (e.g.,is more than 50 MB) or if the aggregate file size of all of the tenattachments exceeds a threshold file size (e.g., is greater than 200MB). In some cases, the deduplication of content may only be performedif the shared content is greater than a threshold amount of data (e.g.,if an attachment is greater than 20 MB). When an email is received,shared content for large attachments and large blocks of common text maybe identified by comparing hashes. The comparing of hash values mayallow large attachments to be identified as already existing within theshared space layer even though the attachment may have been renamed. Insome cases, both the shared space layer and the user specific layer mayhave corresponding secondary layers for facilitating search of theplurality of electronic messages associated with the snapshots of theuser's email mailbox over time.

In some embodiments, the data management and storage system may directthe resources within the end user's cloud-based data storage service toperform a controlled restoration of email snapshots such that sensitiveinformation located within stored snapshots remains protected. In thiscase, prior to restoration, attachments and text blocks that includesensitive information or restricted keywords may be identified andstored in the shared space layer. For example, attachments that includea restricted keyword (e.g., a project codename) or portions of text thatinclude the restricted keyword may be identified and stored in theshared space layer. During restoration, user permissions may determinewhether the attachments and text blocks that include the sensitiveinformation may be restored for a specific user. Data within the sharedspace layer may be restored with the sensitive information redacted ormodified. In one example, the sensitive information may be replaced withpre-approved text. The sensitive information may be identified after apoint in time snapshot has already been created. In this case, theshared space layer and the user specific layer may need to beregenerated to move the sensitive information into the shared spacelayer. The shared space layer may use stronger encryption than the userspecific layer. Furthermore, the data management and storage system maydirect the resources within the end user's cloud-based data storageservice to perform a controlled search of email snapshots such that anysearch results do not include the sensitive information.

In some embodiments, the data management and storage system may directthe resources within the end user's cloud-based data storage service todetect and preserve emails that were received or transmitted and thendeleted between two consecutive snapshots. The data management andstorage system may direct the resources within the end user'scloud-based data storage service to buffer all emails received ortransmitted after a point in time snapshot has been captured and thencompare the buffered emails with those captured in the subsequentsnapshot to identify emails that were received or transmitted and thendeleted prior to the subsequent snapshot. In some cases, the emailsdeleted between the two consecutive snapshots may be stored using ashared space layer (e.g., for attachments or large blocks of text) and auser specific layer. The emails deleted between the two consecutivesnapshots may be stored using a buffer snapshot and a secondary layermay be generated for the buffer snapshot to facilitate indexing.

An integrated data management and storage system may be configured tomanage the automated storage, backup, deduplication, replication,recovery, and archival of data within and across physical and virtualcomputing environments. The integrated data management and storagesystem may provide a unified primary and secondary storage system withbuilt-in data management that may be used as both a backup storagesystem and a “live” primary storage system for primary workloads. Insome cases, the integrated data management and storage system may managethe extraction and storage of historical snapshots associated withdifferent point in time versions of virtual machines and/or realmachines (e.g., a hardware server, a laptop, a tablet computer, asmartphone, or a mobile computing device) and provide near instantaneousrecovery of a backed-up version of a virtual machine, a real machine, orone or more files residing on the virtual machine or the real machine.The integrated data management and storage system may allow backed-upversions of real or virtual machines to be directly mounted or madeaccessible to primary workloads in order to enable the nearinstantaneous recovery of the backed-up versions and allow secondaryworkloads (e.g., workloads for experimental or analytics purposes) todirectly use the integrated data management and storage system as aprimary storage target to read or modify past versions of data.

The integrated data management and storage system may include adistributed cluster of storage nodes that presents itself as a unifiedstorage system even though numerous storage nodes may be connectedtogether and the number of connected storage nodes may change over timeas storage nodes are added to or removed from the cluster. Theintegrated data management and storage system may utilize a scale-outnode based architecture in which a plurality of data storage appliancescomprising one or more nodes are in communication with each other viaone or more networks. Each storage node may include two or moredifferent types of storage devices and control circuitry configured tostore, deduplicate, compress, and/or encrypt data stored using the twoor more different types of storage devices. In one example, a storagenode may include two solid-state drives (SSDs), three hard disk drives(HDDs), and one or more processors configured to concurrently read datafrom and/or write data to the storage devices. The integrated datamanagement and storage system may replicate and distribute versioneddata, metadata, and task execution across the distributed cluster toincrease tolerance to node and disk failures (e.g., snapshots of avirtual machine may be triply mirrored across the cluster). Datamanagement tasks may be assigned and executed across the distributedcluster in a fault tolerant manner based on the location of data withinthe cluster (e.g., assigning tasks to nodes that store data related tothe task) and node resource availability (e.g., assigning tasks to nodeswith sufficient compute or memory capacity for the task).

The integrated data management and storage system may apply a databackup and archiving schedule to backed-up real and virtual machines toenforce various backup service level agreements (SLAs), recovery pointobjectives (RPOs), recovery time objectives (RTOs), data retentionrequirements, and other data backup, replication, and archival policiesacross the entire data lifecycle. For example, the data backup andarchiving schedule may require that snapshots of a virtual machine arecaptured and stored every four hours for the past week, every day forthe past six months, and every week for the past five years.

As virtualization technologies are adopted into information technology(IT) infrastructures, there is a growing need for recovery mechanisms tosupport mission critical application deployment within a virtualizedinfrastructure. However, a virtualized infrastructure may present a newset of challenges to the traditional methods of data management due tothe higher workload consolidation and the need for instant, granularrecovery. The benefits of using an integrated data management andstorage system include the ability to reduce the amount of data storagerequired to backup real and virtual machines, the ability to reduce theamount of data storage required to support secondary or non-productionworkloads, the ability to provide a non-passive storage target in whichbackup data may be directly accessed and modified, and the ability toquickly restore earlier versions of virtual machines and files storedlocally or in the cloud.

FIG. 1A depicts one embodiment of a networked computing environment 100in which the disclosed technology may be practiced. As depicted, thenetworked computing environment 100 includes a data center 150, astorage appliance 140, and a computing device 154 in communication witheach other via one or more networks 180. The networked computingenvironment 100 may include a plurality of computing devicesinterconnected through one or more networks 180. The networked computingenvironment 100 may correspond with or provide access to a cloudcomputing environment providing Software-as-a-Service (SaaS) orInfrastructure-as-a-Service (IaaS) services. The one or more networks180 may allow computing devices and/or storage devices to connect to andcommunicate with other computing devices and/or other storage devices.In some cases, the networked computing environment may include othercomputing devices and/or other storage devices not shown. The othercomputing devices may include, for example, a mobile computing device, anon-mobile computing device, a server, a workstation, a laptop computer,a tablet computer, a desktop computer, or an information processingsystem. The other storage devices may include, for example, a storagearea network storage device, a networked-attached storage device, a harddisk drive, a solid-state drive, or a data storage system. The one ormore networks 180 may include a cellular network, a mobile network, awireless network, a wired network, a secure network such as anenterprise private network, an unsecure network such as a wireless opennetwork, a local area network (LAN), a wide area network (WAN), and theInternet.

The data center 150 may include one or more servers, such as server 160,in communication with one or more storage devices, such as storagedevice 156. The one or more servers may also be in communication withone or more storage appliances, such as storage appliance 170. Theserver 160, storage device 156, and storage appliance 170 may be incommunication with each other via a networking fabric connecting serversand data storage units within the data center to each other. The server160 may comprise a production hardware server. The storage appliance 170may include a data management system for backing up virtual machines,real machines, virtual disks, real disks, and/or electronic files withinthe data center 150. The server 160 may be used to create and manage oneor more virtual machines associated with a virtualized infrastructure.The one or more virtual machines may run various applications, such as adatabase application or a web server. The storage device 156 may includeone or more hardware storage devices for storing data, such as a harddisk drive (HDD), a magnetic tape drive, a solid-state drive (SSD), astorage area network (SAN) storage device, or a networked-attachedstorage (NAS) device. In some cases, a data center, such as data center150, may include thousands of servers and/or data storage devices incommunication with each other. The data storage devices may comprise atiered data storage infrastructure (or a portion of a tiered datastorage infrastructure). The tiered data storage infrastructure mayallow for the movement of data across different tiers of a data storageinfrastructure between higher-cost, higher-performance storage devices(e.g., solid-state drives and hard disk drives) and relativelylower-cost, lower-performance storage devices (e.g., magnetic tapedrives).

A server, such as server 160, may allow a client to download informationor files (e.g., executable, text, application, audio, image, or videofiles) from the server or to perform a search query related toparticular information stored on the server. In some cases, a server mayact as an application server or a file server. In general, a server mayrefer to a hardware device that acts as the host in a client-serverrelationship or a software process that shares a resource with orperforms work for one or more clients. One embodiment of server 160includes a network interface 165, processor 166, memory 167, disk 168,and virtualization manager 169 all in communication with each other.Network interface 165 allows server 160 to connect to one or morenetworks 180. Network interface 165 may include a wireless networkinterface and/or a wired network interface. Processor 166 allows server160 to execute computer readable instructions stored in memory 167 inorder to perform processes described herein. Processor 166 may includeone or more processing units, such as one or more CPUs and/or one ormore GPUs. Memory 167 may comprise one or more types of memory (e.g.,RAM, SRAM, DRAM, EEPROM, Flash, etc.). Disk 168 may include a hard diskdrive and/or a solid-state drive. Memory 167 and disk 168 may comprisehardware storage devices.

The virtualization manager 169 may manage a virtualized infrastructureand perform management operations associated with the virtualizedinfrastructure. For example, the virtualization manager 169 may managethe provisioning of virtual machines running within the virtualizedinfrastructure and provide an interface to computing devices interactingwith the virtualized infrastructure. The virtualization manager 169 mayalso perform various virtual machine related tasks, such as cloningvirtual machines, creating new virtual machines, monitoring the state ofvirtual machines, moving virtual machines between physical hosts forload balancing purposes, and facilitating backups of virtual machines.

One embodiment of storage appliance 170 includes a network interface175, processor 176, memory 177, and disk 178 all in communication witheach other. Network interface 175 allows storage appliance 170 toconnect to one or more networks 180. Network interface 175 may include awireless network interface and/or a wired network interface. Processor176 allows storage appliance 170 to execute computer readableinstructions stored in memory 177 in order to perform processesdescribed herein. Processor 176 may include one or more processingunits, such as one or more CPUs and/or one or more GPUs. Memory 177 maycomprise one or more types of memory (e.g., RAM, SRAM, DRAM, EEPROM, NORFlash, NAND Flash, etc.). Disk 178 may include a hard disk drive and/ora solid-state drive. Memory 177 and disk 178 may comprise hardwarestorage devices.

In one embodiment, the storage appliance 170 may include four machines.Each of the four machines may include a multi-core CPU, 64 GB of RAM, a400 GB SSD, three 4 TB HDDs, and a network interface controller. In thiscase, the four machines may be in communication with the one or morenetworks 180 via the four network interface controllers. The fourmachines may comprise four nodes of a server cluster. The server clustermay comprise a set of physical machines that are connected together viaa network. The server cluster may be used for storing data associatedwith a plurality of virtual machines, such as backup data associatedwith different point in time versions of one or more virtual machines.

In another embodiment, the storage appliance 170 may comprise a virtualappliance that comprises four virtual machines. Each of the virtualmachines in the virtual appliance may have 64 GB of virtual memory, a 12TB virtual disk, and a virtual network interface controller. In thiscase, the four virtual machines may be in communication with the one ormore networks 180 via the four virtual network interface controllers.The four virtual machines may comprise four nodes of a virtual cluster.

The networked computing environment 100 may provide a cloud computingenvironment for one or more computing devices. In one embodiment, thenetworked computing environment 100 may include a virtualizedinfrastructure that provides software, data processing, and/or datastorage services to end users accessing the services via the networkedcomputing environment. In one example, networked computing environment100 may provide cloud-based work productivity or business relatedapplications to a computing device, such as computing device 154. Thecomputing device 154 may comprise a mobile computing device or a tabletcomputer. The storage appliance 140 may comprise a cloud-based datamanagement system for backing up virtual machines and/or files within avirtualized infrastructure, such as virtual machines running on server160 or files stored on server 160.

In some embodiments, the storage appliance 170 may manage the extractionand storage of virtual machine snapshots associated with different pointin time versions of one or more virtual machines running within the datacenter 150. A snapshot of a virtual machine may correspond with a stateof the virtual machine at a particular point in time. In some cases, thesnapshot may capture the state of various virtual machine settings andthe state of one or more virtual disks for the virtual machine. Inresponse to a restore command from the server 160, the storage appliance170 may restore a point in time version of a virtual machine or restorepoint in time versions of one or more files located on the virtualmachine and transmit the restored data to the server 160. In response toa mount command from the server 160, the storage appliance 170 may allowa point in time version of a virtual machine to be mounted and allow theserver 160 to read and/or modify data associated with the point in timeversion of the virtual machine. To improve storage density, the storageappliance 170 may deduplicate and compress data associated withdifferent versions of a virtual machine and/or deduplicate and compressdata associated with different virtual machines. To improve systemperformance, the storage appliance 170 may first store virtual machinesnapshots received from a virtualized environment in a cache, such as aflash-based cache. The cache may also store popular data or frequentlyaccessed data (e.g., based on a history of virtual machinerestorations), incremental files associated with commonly restoredvirtual machine versions, and current day incremental files orincremental files corresponding with snapshots captured within the past24 hours.

An incremental file may comprise a forward incremental file or a reverseincremental file. A forward incremental file may include a set of datarepresenting changes that have occurred since an earlier point in timesnapshot of a virtual machine. To generate a snapshot of the virtualmachine corresponding with a forward incremental file, the forwardincremental file may be combined with an earlier point in time snapshotof the virtual machine (e.g., the forward incremental file may becombined with the last full image of the virtual machine that wascaptured before the forward incremental was captured and any otherforward incremental files that were captured subsequent to the last fullimage and prior to the forward incremental file). A reverse incrementalfile may include a set of data representing changes from a later pointin time snapshot of a virtual machine. To generate a snapshot of thevirtual machine corresponding with a reverse incremental file, thereverse incremental file may be combined with a later point in timesnapshot of the virtual machine (e.g., the reverse incremental file maybe combined with the most recent snapshot of the virtual machine and anyother reverse incremental files that were captured prior to the mostrecent snapshot and subsequent to the reverse incremental file).

The storage appliance 170 may provide a user interface (e.g., aweb-based interface or a graphical user interface) that displays virtualmachine information, such as identifications of the virtual machinesprotected and the historical versions or time machine views for each ofthe virtual machines protected, and allows an end user to search,select, and control virtual machines managed by the storage appliance. Atime machine view of a virtual machine may include snapshots of thevirtual machine over a plurality of points in time. Each snapshot maycomprise the state of the virtual machine at a particular point in time.Each snapshot may correspond with a different version of the virtualmachine (e.g., Version 1 of a virtual machine may correspond with thestate of the virtual machine at a first point in time and Version 2 ofthe virtual machine may correspond with the state of the virtual machineat a second point in time subsequent to the first point in time).

FIG. 1B depicts one embodiment of server 160 in FIG. 1A. The server 160may comprise one server out of a plurality of servers that are networkedtogether within a data center. In one example, the plurality of serversmay be positioned within one or more server racks within the datacenter. As depicted, the server 160 includes hardware-level componentsand software-level components. The hardware-level components include oneor more processors 182, one or more memory 184, and one or more disks185. The software-level components include a hypervisor 186, avirtualized infrastructure manager 199, and one or more virtualmachines, such as virtual machine 198. The hypervisor 186 may comprise anative hypervisor or a hosted hypervisor. The hypervisor 186 may providea virtual operating platform for running one or more virtual machines,such as virtual machine 198. Virtual machine 198 includes a plurality ofvirtual hardware devices including a virtual processor 192, a virtualmemory 194, and a virtual disk 195. The virtual disk 195 may comprise afile stored within the one or more disks 185. In one example, a virtualmachine may include a plurality of virtual disks, with each virtual diskof the plurality of virtual disks associated with a different filestored on the one or more disks 185. Virtual machine 198 may include aguest operating system 196 that runs one or more applications, such asapplication 197. The virtualized infrastructure manager 199, which maycorrespond with the virtualization manager 169 in FIG. 1A, may run on avirtual machine or natively on the server 160. The virtualizedinfrastructure manager 199 may provide a centralized platform formanaging a virtualized infrastructure that includes a plurality ofvirtual machines.

In one embodiment, the server 160 may use the virtualized infrastructuremanager 199 to facilitate backups for a plurality of virtual machines(e.g., eight different virtual machines) running on the server 160. Eachvirtual machine running on the server 160 may run its own guestoperating system and its own set of applications. Each virtual machinerunning on the server 160 may store its own set of files using one ormore virtual disks associated with the virtual machine (e.g., eachvirtual machine may include two virtual disks that are used for storingdata associated with the virtual machine).

In one embodiment, a data management application running on a storageappliance, such as storage appliance 140 in FIG. 1A or storage appliance170 in FIG. 1A, may request a snapshot of a virtual machine running onserver 160. The snapshot of the virtual machine may be stored as one ormore files, with each file associated with a virtual disk of the virtualmachine. A snapshot of a virtual machine may correspond with a state ofthe virtual machine at a particular point in time. The particular pointin time may be associated with a time stamp. In one example, a firstsnapshot of a virtual machine may correspond with a first state of thevirtual machine (including the state of applications and files stored onthe virtual machine) at a first point in time (e.g., 6:30 p.m. on Jun.29, 2017) and a second snapshot of the virtual machine may correspondwith a second state of the virtual machine at a second point in timesubsequent to the first point in time (e.g., 6:30 p.m. on Jun. 30,2017).

In response to a request for a snapshot of a virtual machine at aparticular point in time, the virtualized infrastructure manager 199 mayset the virtual machine into a frozen state or store a copy of thevirtual machine at the particular point in time. The virtualizedinfrastructure manager 199 may then transfer data associated with thevirtual machine (e.g., an image of the virtual machine or a portion ofthe image of the virtual machine) to the storage appliance. The dataassociated with the virtual machine may include a set of files includinga virtual disk file storing contents of a virtual disk of the virtualmachine at the particular point in time and a virtual machineconfiguration file storing configuration settings for the virtualmachine at the particular point in time. The contents of the virtualdisk file may include the operating system used by the virtual machine,local applications stored on the virtual disk, and user files (e.g.,images and word processing documents). In some cases, the virtualizedinfrastructure manager 199 may transfer a full image of the virtualmachine to the storage appliance or a plurality of data blockscorresponding with the full image (e.g., to enable a full image-levelbackup of the virtual machine to be stored on the storage appliance). Inother cases, the virtualized infrastructure manager 199 may transfer aportion of an image of the virtual machine associated with data that haschanged since an earlier point in time prior to the particular point intime or since a last snapshot of the virtual machine was taken. In oneexample, the virtualized infrastructure manager 199 may transfer onlydata associated with changed blocks stored on a virtual disk of thevirtual machine that have changed since the last snapshot of the virtualmachine was taken. In one embodiment, the data management applicationmay specify a first point in time and a second point in time and thevirtualized infrastructure manager 199 may output one or more changeddata blocks associated with the virtual machine that have been modifiedbetween the first point in time and the second point in time.

FIG. 1C depicts one embodiment of a storage appliance, such as storageappliance 170 in FIG. 1A. The storage appliance may include a pluralityof physical machines that may be grouped together and presented as asingle computing system. Each physical machine of the plurality ofphysical machines may comprise a node in a cluster (e.g., a failovercluster). As depicted, the storage appliance 170 includes hardware-levelcomponents and software-level components. The hardware-level componentsinclude one or more physical machines, such as physical machine 120 andphysical machine 130. The physical machine 120 includes a networkinterface 121, processor 122, memory 123, and disk 124 all incommunication with each other. Processor 122 allows physical machine 120to execute computer readable instructions stored in memory 123 toperform processes described herein. Disk 124 may include a hard diskdrive and/or a solid-state drive. The physical machine 130 includes anetwork interface 131, processor 132, memory 133, and disk 134 all incommunication with each other. Processor 132 allows physical machine 130to execute computer readable instructions stored in memory 133 toperform processes described herein. Disk 134 may include a hard diskdrive and/or a solid-state drive. In some cases, disk 134 may include aflash-based SSD or a hybrid HDD/SSD drive. In one embodiment, thestorage appliance 170 may include a plurality of physical machinesarranged in a cluster (e.g., eight machines in a cluster). Each of theplurality of physical machines may include a plurality of multi-coreCPUs, 128 GB of RAM, a 500 GB SSD, four 4 TB HDDs, and a networkinterface controller.

As depicted in FIG. 1C, the software-level components of the storageappliance 170 may include data management system 102, a virtualizationinterface 104, a distributed job scheduler 108, a distributed metadatastore 110, a distributed file system 112, and one or more virtualmachine search indexes, such as virtual machine search index 106. In oneembodiment, the software-level components of the storage appliance 170may be run using a dedicated hardware-based appliance. In anotherembodiment, the software-level components of the storage appliance 170may be run from the cloud (e.g., the software-level components may beinstalled on a cloud service provider).

In some cases, the data storage across a plurality of nodes in a cluster(e.g., the data storage available from the one or more physicalmachines) may be aggregated and made available over a single file systemnamespace (e.g., /snapshots/). A directory for each virtual machineprotected using the storage appliance 170 may be created (e.g., thedirectory for Virtual Machine A may be /snapshots/VM_A). Snapshots andother data associated with a virtual machine may reside within thedirectory for the virtual machine. In one example, snapshots of avirtual machine may be stored in subdirectories of the directory (e.g.,a first snapshot of Virtual Machine A may reside in /snapshots/VM_A/s1/and a second snapshot of Virtual Machine A may reside in/snapshots/VM_A/s2/).

The distributed file system 112 may present itself as a single filesystem, in which as new physical machines or nodes are added to thestorage appliance 170, the cluster may automatically discover theadditional nodes and automatically increase the available capacity ofthe file system for storing files and other data. Each file stored inthe distributed file system 112 may be partitioned into one or morechunks. Each of the one or more chunks may be stored within thedistributed file system 112 as a separate file. The files stored withinthe distributed file system 112 may be replicated or mirrored over aplurality of physical machines, thereby creating a load-balanced andfault tolerant distributed file system. In one example, storageappliance 170 may include ten physical machines arranged as a failovercluster and a first file corresponding with a full-image snapshot of avirtual machine (e.g., /snapshots/VM_A/s1/s1.full) may be replicated andstored on three of the ten machines. In some cases, the data chunksassociated with a file stored in the distributed file system 112 mayinclude replicated data (e.g., due to n-way mirroring) or parity data(e.g., due to erasure coding). When a disk storing one of the datachunks fails, then the distributed file system may regenerate the lostdata and store the lost data using a new disk.

In one embodiment, the distributed file system 112 may be used to storea set of versioned files corresponding with a virtual machine. The setof versioned files may include a first file comprising a full image ofthe virtual machine at a first point in time and a second filecomprising an incremental file relative to the full image. The set ofversioned files may correspond with a snapshot chain for the virtualmachine. The distributed file system 112 may determine a first set ofdata chunks that includes redundant information for the first file(e.g., via application of erasure code techniques) and store the firstset of data chunks across a plurality of nodes within a cluster. Theplacement of the first set of data chunks within the cluster may bedetermined based on the locations of other data related to the first setof data chunks (e.g., the locations of other chunks corresponding withthe second file or other files within the snapshot chain for the virtualmachine). In some embodiments, the distributed file system 112 may alsoco-locate data chunks or replicas of virtual machines discovered to besimilar to each other in order to allow for cross virtual machinededuplication. In this case, the placement of the first set of datachunks may be determined based on the locations of other datacorresponding with a different virtual machine that has been determinedto be sufficiently similar to the virtual machine.

The distributed metadata store 110 may comprise a distributed databasemanagement system that provides high availability without a single pointof failure. The distributed metadata store 110 may act as a quick-accessdatabase for various components in the software stack of the storageappliance 170 and may store metadata corresponding with stored snapshotsusing a solid-state storage device, such as a solid-state drive (SSD) ora Flash-based storage device. In one embodiment, the distributedmetadata store 110 may comprise a database, such as a distributeddocument oriented database. The distributed metadata store 110 may beused as a distributed key value storage system. In one example, thedistributed metadata store 110 may comprise a distributed NoSQL keyvalue store database. In some cases, the distributed metadata store 110may include a partitioned row store, in which rows are organized intotables or other collections of related data held within a structuredformat within the key value store database. A table (or a set of tables)may be used to store metadata information associated with one or morefiles stored within the distributed file system 112. The metadatainformation may include the name of a file, a size of the file, filepermissions associated with the file, when the file was last modified,and file mapping information associated with an identification of thelocation of the file stored within a cluster of physical machines. Inone embodiment, a new file corresponding with a snapshot of a virtualmachine may be stored within the distributed file system 112 andmetadata associated with the new file may be stored within thedistributed metadata store 110. The distributed metadata store 110 mayalso be used to store a backup schedule for the virtual machine and alist of snapshots for the virtual machine that are stored using thestorage appliance 170.

In some cases, the distributed metadata store 110 may be used to manageone or more versions of a virtual machine. The concepts described hereinmay also be applicable to managing versions of a real machine orversions of electronic files. Each version of the virtual machine maycorrespond with a full image snapshot of the virtual machine storedwithin the distributed file system 112 or an incremental snapshot of thevirtual machine (e.g., a forward incremental or reverse incremental)stored within the distributed file system 112. In one embodiment, theone or more versions of the virtual machine may correspond with aplurality of files. The plurality of files may include a single fullimage snapshot of the virtual machine and one or more incrementalsderived from the single full image snapshot. The single full imagesnapshot of the virtual machine may be stored using a first storagedevice of a first type (e.g., a HDD) and the one or more incrementalsderived from the single full image snapshot may be stored using a secondstorage device of a second type (e.g., an SSD). In this case, only asingle full image needs to be stored and each version of the virtualmachine may be generated from the single full image or the single fullimage combined with a subset of the one or more incrementals.Furthermore, each version of the virtual machine may be generated byperforming a sequential read from the first storage device (e.g.,reading a single file from a HDD) to acquire the full image and, inparallel, performing one or more reads from the second storage device(e.g., performing fast random reads from an SSD) to acquire the one ormore incrementals. In some cases, a first version of a virtual machinecorresponding with a first snapshot of the virtual machine at a firstpoint in time may be generated by concurrently reading a full image forthe virtual machine corresponding with a state of the virtual machineprior to the first point in time from the first storage device whilereading one or more incrementals from the second storage devicedifferent from the first storage device (e.g., reading the full imagefrom a HDD at the same time as reading 64 incrementals from an SSD).

The distributed job scheduler 108 may comprise a distributed faulttolerant job scheduler, in which jobs affected by node failures arerecovered and rescheduled to be run on available nodes. In oneembodiment, the distributed job scheduler 108 may be fully decentralizedand implemented without the existence of a master node. The distributedjob scheduler 108 may run job scheduling processes on each node in acluster or on a plurality of nodes in the cluster and each node mayindependently determine which tasks to execute. The distributed jobscheduler 108 may be used for scheduling backup jobs that acquire andstore virtual machine snapshots for one or more virtual machines overtime. The distributed job scheduler 108 may follow a backup schedule tobackup an entire image of a virtual machine at a particular point intime or one or more virtual disks associated with the virtual machine atthe particular point in time.

The job scheduling processes running on at least a plurality of nodes ina cluster (e.g., on each available node in the cluster) may manage thescheduling and execution of a plurality of jobs. The job schedulingprocesses may include run processes for running jobs, cleanup processesfor cleaning up failed tasks, and rollback processes for rolling-back orundoing any actions or tasks performed by failed jobs. In oneembodiment, the job scheduling processes may detect that a particulartask for a particular job has failed and in response may perform acleanup process to clean up or remove the effects of the particular taskand then perform a rollback process that processes one or more completedtasks for the particular job in reverse order to undo the effects of theone or more completed tasks. Once the particular job with the failedtask has been undone, the job scheduling processes may restart theparticular job on an available node in the cluster.

The virtualization interface 104 may provide an interface forcommunicating with a virtualized infrastructure manager managing avirtualized infrastructure, such as the virtualized infrastructuremanager 199 in FIG. 1B, and for requesting data associated with virtualmachine snapshots from the virtualized infrastructure. Thevirtualization interface 104 may communicate with the virtualizedinfrastructure manager using an API for accessing the virtualizedinfrastructure manager (e.g., to communicate a request for a snapshot ofa virtual machine).

The virtual machine search index 106 may include a list of files thathave been stored using a virtual machine and a version history for eachof the files in the list. Each version of a file may be mapped to theearliest point in time snapshot of the virtual machine that includes theversion of the file or to a snapshot of the virtual machine thatincludes the version of the file (e.g., the latest point in timesnapshot of the virtual machine that includes the version of the file).In one example, the virtual machine search index 106 may be used toidentify a version of the virtual machine that includes a particularversion of a file (e.g., a particular version of a database, aspreadsheet, or a word processing document). In some cases, each of thevirtual machines that are backed up or protected using storage appliance170 may have a corresponding virtual machine search index.

The data management system 102 may comprise an application running onthe storage appliance that manages the capturing, storing,deduplication, compression (e.g., using a lossless data compressionalgorithm such as LZ4 or LZ77), and encryption (e.g., using a symmetrickey algorithm such as Triple DES or AES-256) of data for the storageappliance 170. In one example, the data management system 102 maycomprise a highest level layer in an integrated software stack runningon the storage appliance. The integrated software stack may include thedata management system 102, the virtualization interface 104, thedistributed job scheduler 108, the distributed metadata store 110, andthe distributed file system 112. In some cases, the integrated softwarestack may run on other computing devices, such as a server or computingdevice 154 in FIG. 1A. The data management system 102 may use thevirtualization interface 104, the distributed job scheduler 108, thedistributed metadata store 110, and the distributed file system 112 tomanage and store one or more snapshots of a virtual machine. Eachsnapshot of the virtual machine may correspond with a point in timeversion of the virtual machine. The data management system 102 maygenerate and manage a list of versions for the virtual machine. Eachversion of the virtual machine may map to or reference one or morechunks and/or one or more files stored within the distributed filesystem 112. Combined together, the one or more chunks and/or the one ormore files stored within the distributed file system 112 may comprise afull image of the version of the virtual machine.

In some embodiments, a plurality of versions of a virtual machine may bestored as a base file associated with a complete image of the virtualmachine at a particular point in time and one or more incremental filesassociated with forward and/or reverse incremental changes derived fromthe base file. The data management system 102 may patch together thebase file and the one or more incremental files in order to generate aparticular version of the plurality of versions by adding and/orsubtracting data associated with the one or more incremental files fromthe base file or intermediary files derived from the base file. In someembodiments, each version of the plurality of versions of a virtualmachine may correspond with a merged file. A merged file may includepointers or references to one or more files and/or one or more chunksassociated with a particular version of a virtual machine. In oneexample, a merged file may include a first pointer or symbolic link to abase file and a second pointer or symbolic link to an incremental fileassociated with the particular version of the virtual machine. In someembodiments, the one or more incremental files may correspond withforward incrementals (e.g., positive deltas), reverse incrementals(e.g., negative deltas), or a combination of both forward incrementalsand reverse incrementals.

FIG. 1D depicts one embodiment of a portion of an integrated datamanagement and storage system that includes a plurality of nodes incommunication with each other and one or more storage devices via one ormore networks 180. The plurality of nodes may be networked together andpresent themselves as a unified storage system. The plurality of nodesincludes node 141 and node 147. The one or more storage devices includestorage device 157 and storage device 158. Storage device 157 maycorrespond with a cloud-based storage (e.g., private or public cloudstorage). Storage device 158 may comprise a hard disk drive (HDD), amagnetic tape drive, a solid-state drive (SSD), a storage area network(SAN) storage device, or a networked-attached storage (NAS) device. Theintegrated data management and storage system may comprise a distributedcluster of storage appliances in which each of the storage appliancesincludes one or more nodes. In one embodiment, node 141 and node 147 maycomprise two nodes housed within a first storage appliance, such asstorage appliance 170 in FIG. 1C. In another embodiment, node 141 maycomprise a first node housed within a first storage appliance and node147 may comprise a second node housed within a second storage appliancedifferent from the first storage appliance. The first storage applianceand the second storage appliance may be located within a data center,such as data center 150 in FIG. 1A, or located within different datacenters.

As depicted, node 141 includes a network interface 142, a nodecontroller 143, and a first plurality of storage devices including HDDs144-145 and SSD 146. The first plurality of storage devices may comprisetwo or more different types of storage devices. The node controller 143may comprise one or more processors configured to store, deduplicate,compress, and/or encrypt data stored within the first plurality ofstorage devices. Node 147 includes a network interface 148, a nodecontroller 149, and a second plurality of storage devices including HDDs151-152 and SSD 153. The second plurality of storage devices maycomprise two or more different types of storage devices. The nodecontroller 149 may comprise one or more processors configured to store,deduplicate, compress, and/or encrypt data stored within the secondplurality of storage devices. In some cases, node 141 may correspondwith physical machine 120 in FIG. 1C and node 147 may correspond withphysical machine 130 in FIG. 1C.

FIGS. 2A-2K depict various embodiments of sets of files and datastructures (e.g., implemented using merged files) associated withmanaging and storing snapshots of virtual machines. Although variousembodiments may be described in reference to the management of virtualmachine snapshots, the concepts may be applied to the management ofother data snapshots as well, such as snapshots of databases, filesets(e.g., Network Attached Storage filesets), and sets of electronic files.

FIG. 2A depicts one embodiment of a set of virtual machine snapshotsstored as a first set of files. The first set of files may be storedusing a distributed file system, such as distributed file system 112 inFIG. 1C. As depicted, the first set of files includes a set of reverseincrementals (R1-R4), a full image (Base), and a set of forwardincrementals (F1-F2). The set of virtual machine snapshots includesdifferent versions of a virtual machine (versions V1-V7 of VirtualMachine A) captured at different points in time (times T1-T7). In somecases, the file size of the reverse incremental R3 and the file size ofthe forward incremental F2 may both be less than the file size of thebase image corresponding with version V5 of Virtual Machine A. The baseimage corresponding with version V5 of Virtual Machine A may comprise afull image of Virtual Machine A at point in time T5. The base image mayinclude a virtual disk file for Virtual Machine A at point in time T5.The reverse incremental R3 corresponds with version V2 of VirtualMachine A and the forward incremental F2 corresponds with version V7 ofVirtual Machine A. The forward incremental F1 may be associated with thedata changes that occurred to Virtual Machine A between time T5 and timeT6 and may comprise one or more changed data blocks.

In some embodiments, each snapshot of the set of virtual machinesnapshots may be stored within a storage appliance, such as storageappliance 170 in FIG. 1A. In other embodiments, a first set of the setof virtual machine snapshots may be stored within a first storageappliance and a second set of the set of virtual machine snapshots maybe stored within a second storage appliance, such as storage appliance140 in FIG. 1A. In this case, a data management system may extend acrossboth the first storage appliance and the second storage appliance. Inone example, the first set of the set of virtual machine snapshots maybe stored within a local cluster repository (e.g., recent snapshots ofthe file may be located within a first data center) and the second setof the set of virtual machine snapshots may be stored within a remotecluster repository (e.g., older snapshots or archived snapshots of thefile may be located within a second data center) or a cloud repository.

FIG. 2B depicts one embodiment of a merged file for generating versionV7 of Virtual Machine A using the first set of files depicted in FIG.2A. The merged file includes a first pointer (pBase) that references thebase image Base (e.g., via the path/snapshots/VM_A/s5/s5.full), a secondpointer (pF1) that references the forward incremental F1 (e.g., via thepath /snapshots/VM_A/s6/s6.delta), and a third pointer (pF2) thatreferences the forward incremental F2 (e.g., via the path/snapshots/VM_A/s7/s7.delta). In one embodiment, to generate the fullimage of version V7 of Virtual Machine A, the base image may beacquired, the data changes associated with forward incremental F1 may beapplied to (or patched to) the base image to generate an intermediateimage, and then the data changes associated with forward incremental F2may be applied to the intermediate image to generate the full image ofversion V7 of Virtual Machine A.

FIG. 2C depicts one embodiment of a merged file for generating versionV2 of Virtual Machine A using the first set of files depicted in FIG.2A. The merged file includes a first pointer (pBase) that references thebase image Base (e.g., via the path/snapshots/VM_A/s5/s5.full), a secondpointer (pR1) that references the reverse incremental R1 (e.g., via thepath /snapshots/VM_A/s4/s4.delta), a third pointer (pR2) that referencesthe reverse incremental R2 (e.g., via the path/snapshots/VM_A/s3/s3.delta), and a fourth pointer (pR3) that referencesthe reverse incremental R3 (e.g., via the path/snapshots/VM_A/s2/s2.delta). In one embodiment, to generate the fullimage of version V2 of Virtual Machine A, the base image may beacquired, the data changes associated with reverse incremental R1 may beapplied to the base image to generate a first intermediate image, thedata changes associated with reverse incremental R2 may be applied tothe first intermediate image to generate a second intermediate image,and then the data changes associated with reverse incremental R3 may beapplied to the second intermediate image to generate the full image ofversion V2 of Virtual Machine A.

FIG. 2D depicts one embodiment of a set of virtual machine snapshotsstored as a second set of files after a rebasing process has beenperformed using the first set of files in FIG. 2A. The second set offiles may be stored using a distributed file system, such as distributedfile system 112 in FIG. 1C. The rebasing process may generate new filesR12, R11, and Base2 associated with versions V5-V7 of Virtual Machine Ain order to move a full image closer to a more recent version of VirtualMachine A and to improve the reconstruction time for the more recentversions of Virtual Machine A. The data associated with the full imageBase in FIG. 2A may be equivalent to the new file R12 patched over R11and the full image Base2. Similarly, the data associated with the fullimage Base2 may be equivalent to the forward incremental F2 in FIG. 2Apatched over F1 and the full image Base in FIG. 2A.

The process of moving the full image snapshot for the set of virtualmachine snapshots to correspond with the most recent snapshot versionmay be performed in order to shorten or reduce the chain lengths for thenewest or most recent snapshots, which may comprise the snapshots ofVirtual Machine A that are the most likely to be accessed. In somecases, a rebasing operation (e.g., that moves the full image snapshotfor a set of virtual machine snapshots to correspond with the mostrecent snapshot version) may be triggered when a number of forwardincremental files is greater than a threshold number of forwardincremental files for a snapshot chain (e.g., more than 200 forwardincremental files). In other cases, a rebasing operation may betriggered when the total disk size for the forward incremental filesexceeds a threshold disk size (e.g., is greater than 200 GB) or isgreater than a threshold percentage (e.g., is greater than 20%) of thebase image for the snapshot chain.

In some cases, the rebasing process may be part of a periodic rebasingprocess that is applied at a rebasing frequency (e.g., every 24 hours)to each virtual machine of a plurality of protected virtual machines toreduce the number of forward incremental files that need to be patchedto a base image in order to restore the most recent version of a virtualmachine. Periodically reducing the number of forward incremental filesmay reduce the time to restore the most recent version of the virtualmachine as the number of forward incremental files that need to beapplied to a base image to generate the most recent version may belimited. In one example, if a rebasing process is applied to snapshotsof a virtual machine every 24 hours and snapshots of the virtual machineare acquired every four hours, then the number of forward incrementalfiles may be limited to at most five forward incremental files.

As depicted, the second set of files includes a set of reverseincrementals (R11-R12 and R1-R4) and a full image (Base2). The set ofvirtual machine snapshots includes the different versions of the virtualmachine (versions V1-V7 of Virtual Machine A) captured at the differentpoints in time (times T1-T7) depicted in FIG. 2A. In some cases, thefile size of the reverse incremental R2 may be substantially less thanthe file size of the base image Base2. The reverse incremental R2corresponds with version V2 of Virtual Machine A and the base imageBase2 corresponds with version V7 of Virtual Machine A. In this case,the most recent version of Virtual Machine A (i.e., the most recentrestore point for Virtual Machine A) comprises a full image. To generateearlier versions of Virtual Machine A, reverse incrementals may beapplied to (or patched to) the full image Base2. Subsequent versions ofVirtual Machine A may be stored as forward incrementals that depend fromthe full image Base2.

In one embodiment, a rebasing process may be applied to a first set offiles associated with a virtual machine in order to generate a secondset of files to replace the first set of files. The first set of filesmay include a first base image from which a first version of the virtualmachine may be derived and a first forward incremental file from which asecond version of the virtual machine may be derived. The second set offiles may include a second reverse incremental file from which the firstversion of the virtual machine may be derived and a second base imagefrom which the second version of the virtual machine may be derived.During the rebasing process, data integrity checking may be performed todetect and correct data errors in the files stored in a file system,such as distributed file system 112 in FIG. 1C, that are read togenerate the second set of files.

FIG. 2E depicts one embodiment of a merged file for generating versionV7 of Virtual Machine A using the second set of files depicted in FIG.2D. The merged file includes a first pointer (pBase2) that referencesthe base image Base2 (e.g., via the path/snapshots/VM_A/s7/s7.full). Inthis case, the full image of version V7 of Virtual Machine A may bedirectly acquired without patching forward incrementals or reverseincrementals to the base image Base2 corresponding with version V7 ofVirtual Machine A.

FIG. 2F depicts one embodiment of a merged file for generating versionV2 of Virtual Machine A using the second set of files depicted in FIG.2D. The merged file includes a first pointer (pBase2) that referencesthe base image Base2 (e.g., via the path/snapshots/VM_A/s7/s7.full), asecond pointer (pR11) that references the reverse incremental R11 (e.g.,via the path /snapshots/VM_A/s6/s6.delta), a third pointer (pR12) thatreferences the reverse incremental R12 (e.g., via thepath/snapshots/VM_A/s5/s5.delta), a fourth pointer (pR1) that referencesthe reverse incremental R1 (e.g., via thepath/snapshots/VM_A/s4/s4.delta), a fifth pointer (pR2) that referencesthe reverse incremental R2 (e.g., via thepath/snapshots/VM_A/s3/s3.delta), and a sixth pointer (pR3) thatreferences the reverse incremental R3 (e.g., via thepath/snapshots/VM_A/s2/s2.delta). In one embodiment, to generate thefull image of version V2 of Virtual Machine A, the base image may beacquired, the data changes associated with reverse incremental R11 maybe applied to the base image to generate a first intermediate image, thedata changes associated with reverse incremental R12 may be applied tothe first intermediate image to generate a second intermediate image,the data changes associated with reverse incremental R1 may be appliedto the second intermediate image to generate a third intermediate image,the data changes associated with reverse incremental R2 may be appliedto the third intermediate image to generate a fourth intermediate image,and then the data changes associated with reverse incremental R3 may beapplied to the fourth intermediate image to generate the full image ofversion V2 of Virtual Machine A.

FIG. 2G depicts one embodiment of a set of files associated withmultiple virtual machine snapshots. The set of files may be stored usinga distributed file system, such as distributed file system 112 in FIG.1C. As depicted, the set of files includes a second full image (BaseB),a set of forward incrementals (F1-F2 and F5-F6) that derive from thesecond full image (BaseB), and a set of reverse incrementals (R1-R3)that derive from the second full image (BaseB). The set of files alsoincludes a first full image (BaseA) and a reverse incremental (R4) thatderives from the first full image (BaseA). In this case, the depictedsnapshots for Virtual Machine A include two different full imagesnapshots (BaseA and BaseB). Each of the full image snapshots maycomprise an anchor snapshot for a snapshot chain. The first full image(BaseA) and the reverse incremental (R4) may comprise a first snapshotchain with the first full image acting as the anchor snapshot. A secondsnapshot chain may comprise the second full image (BaseB) acting as theanchor snapshot for the second snapshot chain, the set of forwardincrementals (F1-F2), and the set of reverse incrementals (R1-R3). Thefirst snapshot chain and the second snapshot chain may be independent ofeach other and independently managed. For example, the base imageassociated with the second snapshot chain for Virtual Machine A may berepositioned (e.g., via rebasing) without impacting the first snapshotchain for Virtual Machine A.

A third snapshot chain for Virtual Machine C may comprise the secondfull image (BaseB) and forward incrementals (F1 and F5-F6). The firstsnapshot chain for Virtual Machine A and the third snapshot chain forVirtual Machine C may be independent of each other and independentlymanaged. However, as Virtual Machine C is a dependent virtual machinethat depends from the second snapshot chain for Virtual Machine A,changes to the second snapshot chain may impact the third snapshotchain. For example, repositioning of the base image for the secondsnapshot chain due to rebasing may require the merged files for thethird snapshot chain to be updated.

In some embodiments, each of the snapshot chains for Virtual Machine Amay have a maximum incremental chain length (e.g., no more than 100total incremental files), a maximum reverse incremental chain length(e.g., no more than 50 reverse incremental files), and a maximum forwardincremental chain length (e.g., no more than 70 forward incrementalfiles. In the event that a new snapshot will cause one of the snapshotchains to violate the maximum incremental chain length, the maximumreverse incremental chain length, or the maximum forward incrementalchain length, then a new snapshot chain may be created for VirtualMachine A and a new full-image base file may be stored for the newsnapshot chain.

FIG. 2H depicts one embodiment of a merged file for generating versionVS of Virtual Machine A using the set of files depicted in FIG. 2G. Themerged file includes a first pointer (pBaseA) that references the firstbase image BaseA and a second pointer (pR4) that references the reverseincremental R4. In one embodiment, to generate the full image of versionVS of Virtual Machine A, the first base image associated with Version VTof Virtual Machine A may be acquired and the data changes associatedwith reverse incremental R4 may be applied to the first base image togenerate the full image of version VS of Virtual Machine A.

FIG. 2I depicts one embodiment of a merged file for generating versionVU of Virtual Machine A using the set of files depicted in FIG. 2G. Themerged file includes a first pointer (pBaseB) that references the secondbase image BaseB, a second pointer (pR1) that references the reverseincremental R1, a third pointer (pR2) that references the reverseincremental R2, and a fourth pointer (pR3) that references the reverseincremental R3. In one embodiment, to generate the full image of versionVU of Virtual Machine A, the second base image associated with VersionVY of Virtual Machine A may be acquired, the data changes associatedwith reverse incremental R1 may be applied to the second base image togenerate a first intermediate image, the data changes associated withreverse incremental R2 may be applied to the first intermediate image togenerate a second intermediate image, and the data changes associatedwith reverse incremental R3 may be applied to the second intermediateimage to generate the full image of version VU of Virtual Machine A.

FIG. 2J depicts one embodiment of a set of files associated withmultiple virtual machine snapshots after a rebasing process has beenperformed to a snapshot chain using the set of files in FIG. 2G. The setof files may be stored using a distributed file system, such asdistributed file system 112 in FIG. 1C. The rebasing process maygenerate new files R12, R11, and BaseB2. As depicted, the set of filesincludes a set of reverse incrementals (R11-R12 and R1-R2), a full image(BaseB2), and a set of forward incrementals (F5-F7). In this case, asecond version of Virtual Machine C may be generated using forwardincrementals F5-F6 that are derived from Version VZ of Virtual MachineA. Forward incremental file F7 may include changes to Version VW ofVirtual Machine A that occurred subsequent to the generation of the fullimage file BaseB2. In some cases, the forward incremental file F7 maycomprise a writeable file or have file permissions allowing modificationof the file, while all other files associated with earlier versions ofVirtual Machine A comprise read only files.

FIG. 2K depicts one embodiment of a merged file for generating versionVU of Virtual Machine A using the set of files depicted in FIG. 2J. Themerged file includes a first pointer (pBaseA) that references the firstbase image BaseA and a second pointer (pF9) that references the forwardincremental F9. In one embodiment, to generate the full image of versionVU of Virtual Machine A, the first base image associated with Version VTof Virtual Machine A may be acquired and the data changes associatedwith forward incremental F9 may be applied to the first base image togenerate the full image of version VU of Virtual Machine A.

In some embodiments, upon detection that a second snapshot chain hasreached a maximum incremental chain length (e.g., no more than 500 totalincremental files), a maximum reverse incremental chain length (e.g., nomore than 400 reverse incremental files), or a maximum forwardincremental chain length (e.g., no more than 150 forward incrementalfiles), an existing snapshot chain (e.g., the first snapshot chaindepicted in FIG. 2J) may have its chain length extended or snapshotspreviously assigned to the second snapshot chain may be moved to theexisting snapshot chain. For example, the first snapshot chain depictedin FIG. 2G comprises two total snapshots, while the first snapshot chaindepicted in FIG. 2J comprises three total snapshots as the snapshotcorresponding with version VU of Virtual Machine A has moved from thesecond snapshot chain to the first snapshot chain.

In some embodiments, the number of snapshots in a snapshot chain maydecrease over time as older versions of a virtual machine areconsolidated, archived, deleted, or moved to a different storage domain(e.g., to cloud storage) depending on the data backup and archivingschedule for the virtual machine. In some cases, the maximum incrementalchain length or the maximum number of snapshots for a snapshot chain maybe increased over time as the versions stored by the snapshot chain age.In one example, if the versions of a virtual machine stored using asnapshot chain are all less than one month old, then the maximumincremental chain length may be set to a maximum of 200 incrementals;however, if the versions of the virtual machine stored using thesnapshot chain are all greater than one month old, then the maximumincremental chain length may be set to a maximum of 1000 incrementals.

In some embodiments, the maximum incremental chain length for a snapshotchain may be increased over time as the number of allowed snapshots in asnapshot chain may be increased as the backed-up versions of a virtualmachine get older. For example, the maximum incremental chain length fora snapshot chain storing versions of a virtual machine that are lessthan one year old may comprise a maximum incremental chain length of 200incrementals, while the maximum incremental chain length for a snapshotchain storing versions of a virtual machine that are more than one yearold may comprise a maximum incremental chain length of 500 incrementals.

FIG. 3A is a flowchart describing one embodiment of a process formanaging and storing virtual machine snapshots using a data storagesystem. In one embodiment, the process of FIG. 3A may be performed by astorage appliance, such as storage appliance 170 in FIG. 1A.

In step 302, a schedule for backing up a first virtual machine isdetermined. In one example, the schedule for backing up the firstvirtual machine may comprise periodically backing up the first virtualmachine every four hours. The schedule for backing up the first virtualmachine may be derived from a new backup, replication, and archivalpolicy or backup class assigned to the first virtual machine. In step304, a job scheduler is configured to implement the schedule for backingup the first virtual machine. In one example, a distributed jobscheduler, such as distributed job scheduler 108 in FIG. 1C, may beconfigured to schedule and run processes for capturing and storingimages of the first virtual machine over time according the schedule. Instep 306, a snapshot process for acquiring a snapshot of the firstvirtual machine is initiated. The snapshot process may send aninstruction to a virtualized infrastructure manager, such asvirtualization manager 169 in FIG. 1A, that requests data associatedwith the snapshot of the first virtual machine. In step 308, a type ofsnapshot to be stored is determined. The type of snapshot may comprise afull image snapshot or an incremental snapshot. In some cases, a fullimage snapshot may be captured and stored in order to serve as an anchorsnapshot for a new snapshot chain. Versions of the first virtual machinemay be stored using one or more independent snapshot chains, whereineach snapshot chain comprises a full image snapshot and one or moreincremental snapshots. One embodiment of a process for determining thetype of snapshot to be stored (e.g., storing either a full imagesnapshot or an incremental snapshot) is described later in reference toFIG. 3B.

In step 310, it is determined whether a full image of the first virtualmachine needs to be stored in order to store the snapshot of the firstvirtual machine. The determination of whether a full image is requiredmay depend on whether a previous full image associated with a priorversion of the first virtual machine has been acquired. Thedetermination of whether a full image is required may depend on thedetermination of the type of snapshot to be stored in step 308. If afull image needs to be stored, then step 311 is performed. Otherwise, ifa full image does not need to be stored, then step 312 is performed. Instep 311, the full image of the first virtual machine is acquired. Thefull image of the first virtual machine may correspond with a file orone or more data chunks. In step 312, changes relative to a priorversion of the first virtual machine or relative to another virtualmachine (e.g., in the case that the first virtual machine comprises adependent virtual machine whose snapshots derive from a full imagesnapshot of a second virtual machine different from the first virtualmachine) are acquired. The changes relative to the prior version of thefirst virtual machine or relative to a version of a different virtualmachine may correspond with a file or one or more data chunks. In step313, the full image of the first virtual machine is stored using adistributed file system, such as distributed file system 112 in FIG. 1C.In step 314, the changes relative to the prior version of the firstvirtual machine or relative to another virtual machine are stored usinga distributed file system, such as distributed file system 112 in FIG.1C. In one embodiment, the full image of the first virtual machine maybe stored using a first storage device of a first type (e.g., a HDD) andthe changes relative to the prior version of the first virtual machinemay be stored using a second storage device of a second type (e.g., anSSD).

In some embodiments, snapshots of the first virtual machine may beingested at a snapshot capture frequency (e.g., every 30 minutes) by adata storage system. When a snapshot of the first virtual machine isingested, the snapshot may be compared with other snapshots storedwithin the data storage system in order to identify a candidate snapshotfrom which the snapshot may depend. In one example, a scalableapproximate matching algorithm may be used to identify the candidatesnapshot whose data most closely matches the data associated with thesnapshot or to identify the candidate snapshot whose data has the fewestnumber of data differences with the snapshot. In another example, anapproximate matching algorithm may be used to identify the candidatesnapshot whose data within a first portion of the candidate snapshotmost closely matches data associated with a first portion of thesnapshot. In some cases, a majority of the data associated with thesnapshot and the candidate snapshot may be identical (e.g., both thesnapshot and the candidate snapshot may be associated with virtualmachines that use the same operating system and have the sameapplications installed). Once the candidate snapshot has beenidentified, then data differences (or the delta) between the snapshotand the candidate snapshot may be determined and the snapshot may bestored based on the data differences. In one example, the snapshot maybe stored using a forward incremental file that includes the datadifferences between the snapshot and the candidate snapshot. The forwardincremental file may be compressed prior to being stored within a filesystem, such as distributed file system 112 in FIG. 1C.

In step 316, a merged file associated with the snapshot is generated.The merged file may reference one or more files or one or more datachunks that have been acquired in either step 311 or step 312. In oneexample, the merged file may comprise a file or a portion of a file thatincludes pointers to the one or more files or the one or more datachunks. In step 318, the merged file is stored in a metadata store, suchas distributed metadata store 110 in FIG. 1C. In step 320, a virtualmachine search index for the first virtual machine is updated. Thevirtual machine search index for the first virtual machine may include alist of files that have been stored in the first virtual machine and aversion history for each of the files in the list. In one example, thevirtual machine search index for the first virtual machine may beupdated to include new files that have been added to the first virtualmachine since a prior snapshot of the first virtual machine was takenand/or to include updated versions of files that were previously storedin the first virtual machine.

FIG. 3B is a flowchart describing one embodiment of a process fordetermining the type of snapshot to be stored using a data storagesystem. The process described in FIG. 3B is one example of a process forimplementing step 308 in FIG. 3A. In one embodiment, the process of FIG.3B may be performed by a storage appliance, such as storage appliance170 in FIG. 1A.

In step 332, a snapshot chain for a first virtual machine is identified.The snapshot chain may comprise a full image snapshot for the firstvirtual machine and one or more incremental snapshots that derive fromthe full image snapshot. Backed-up versions of the first virtual machinemay correspond with one or more snapshot chains. Each of the one or moresnapshot chains may include a full image snapshot or a base image fromwhich incremental snapshots may derive.

In step 334, it is determined whether the snapshot chain includes adependent base file. In this case, the first virtual machine maycomprise a dependent virtual machine that has snapshots that derive froma full image snapshot of a different virtual machine. In one embodiment,the first virtual machine and the different virtual machine from whichthe first virtual machine depends may each have different virtualmachine configuration files for storing configuration settings for thevirtual machines. In one example, the first virtual machine may have afirst number of virtual processors (e.g., two processors) and thedifferent virtual machine may have a second number of virtual processorsdifferent from the first number of virtual processors (e.g., fourprocessors). In another example, the first virtual machine may have afirst virtual memory size (e.g., 1 GB) and the different virtual machinemay have a second virtual memory size different from the first virtualmemory size (e.g., 2 GB). In another example, the first virtual machinemay run a first guest operating system and the different virtual machinemay run a second guest operating system different from the first guestoperating system.

In step 336, a maximum incremental chain length for the snapshot chainis determined based on whether the snapshot chain includes a dependentbase file. In one example, if the first virtual machine comprises adependent virtual machine, then the maximum incremental chain length maybe set to a maximum length of 200 snapshots; however if the firstvirtual machine is independent and is not a dependent virtual machine,then the maximum incremental chain length may be set to a maximum lengthof 500 snapshots.

In one embodiment, the maximum incremental chain length for the snapshotchain may be determined based on an age of the backed-up versions withinthe snapshot chain. In one example, the maximum incremental chain lengthfor a snapshot chain storing versions of the first virtual machine thatare less than one year old may comprise a maximum incremental chainlength of 100 incrementals, while the maximum incremental chain lengthfor a snapshot chain storing versions of the first virtual machine thatare more than one year old may comprise a maximum incremental chainlength of 200 incrementals.

In step 338, it is determined whether a new snapshot chain should becreated based on the maximum incremental chain length. In step 340, atype of snapshot to be stored for the first virtual machine isdetermined based on the maximum incremental chain length. The type ofsnapshot may comprise either a full image snapshot or an incrementalsnapshot. In one embodiment, if the snapshot chain for the first virtualmachine exceeds the maximum incremental chain length for the snapshotchain, then the type of snapshot to be stored for the first virtualmachine may comprise a full image snapshot. In this case, an additionalsnapshot chain may be created for the first virtual machine.

In some embodiments, the number of snapshots in a snapshot chain maydecrease over time as older versions of a virtual machine areconsolidated, archived, deleted, or moved to a different storage domain(e.g., to cloud storage) depending on the data backup and archivingschedule for the virtual machine. In some cases, the maximum incrementalchain length or the maximum number of snapshots for a snapshot chain maybe increased over time as the versions stored by the snapshot chain age.In one example, if the versions of a virtual machine stored using asnapshot chain are all less than one month old, then the maximumincremental chain length may be set to a maximum of 200 incrementals;however, if the versions of the virtual machine stored using thesnapshot chain are all greater than one month old, then the maximumincremental chain length may be set to a maximum of 1000 incrementals.

FIG. 3C is a flowchart describing one embodiment of a process forrestoring a version of a virtual machine using a data storage system. Inone embodiment, the process of FIG. 3C may be performed by a storageappliance, such as storage appliance 170 in FIG. 1A.

In step 382, a particular version of a virtual machine to be restored isidentified. In step 384, a base image from which the particular versionmay be derived is determined. In step 386, a set of incremental filesfor generating the particular version is determined. In one embodiment,the base image and the set of incremental files may be determined from amerged file associated with the particular version of the virtualmachine. In some cases, the set of incremental files may include one ormore forward incremental files and/or one or more reverse incrementalfiles. In step 388, a file associated with the particular version isgenerated using the base image and the set of incremental files. Thefile may be generated by patching the set of incremental files onto thebase image. In step 390, at least a portion of the file is outputted.The at least a portion of the file may be electronically transferred toa computing device, such as computing device 154 in FIG. 1A, or to avirtualization manager, such as virtualization manager 169 in FIG. 1A.

To protect their data, an end user or a customer (e.g., a company) of acloud-based service (e.g., a cloud-based email service or a cloud-basedword processing application) may require that data backups of datastored within the cloud-based service are transferred to and storedwithin a cloud-based storage account that is controlled by the end useror the customer. The restriction to never transfer the data backupsoutside of the cloud-based storage account that is owned or controlledby the end user or customer allows the end user or customer to retaincompletely control over their data. In this case, the end user mayprovide restricted access to compute and data storage resources withintheir cloud-based storage account in order to perform data backupoperations. The data storage resources may include binary large object(blob) storage, object storage, block storage, file storage, diskstorage, or table storage. In one example, an external user may be givenpermissions to access and control compute and data storage resourceswithin a resource group of the cloud-based storage account in order toorchestrate data backup operations, such as when and how to capture andstore snapshots of a set of data that is being backed up, and to performsearch index generation operations.

FIG. 4A depicts one embodiment of a cloud computing environment thatincludes a customer cloud service 402 and a customer cloud storage 404in communication with the customer cloud service 402. The customer cloudservice 402 may comprise a cloud-based subscription service (e.g.,Office 365), a cloud-based file service (e.g., OneDrive), or acloud-based productivity application. The customer cloud storage 404 maycomprise a cloud-based storage service (e.g., Azure or S3). The customercloud storage 404 may include resources 412 that may comprise computingand/or storage resources for storing snapshots of data from the customercloud service 402, generating search indexes for the stored snapshots,and generating secondary layers comprising extracted portions of thestored snapshots from which the search indexes may be generated.

FIG. 4B depicts the cloud computing environment of FIG. 4A in which dataand metadata from the customer cloud service 402 are stored within thecustomer cloud storage 404. As depicted, the resources 412 have beenused to direct the customer cloud storage 404 to obtain data associatedwith snapshots 414 from the customer cloud service 402. The data backupand index generation controller 420 may direct the resources 412 withinthe customer cloud storage 404 to acquire the data associated withsnapshots 414 from the customer cloud service 402. The data backup andindex generation controller 420 may direct the resources 412 within thecustomer cloud storage 404 via one or more instructions transmitted tothe resources 412. The data backup and index generation controller 420may comprise a storage appliance, such as storage appliance 140 in FIG.1A or a cloud-based SaaS platform that is configured to perform datamanagement operations. The data backup and index generation controller420 may orchestrate the capturing and storing of snapshots of datawithin the customer cloud storage 404 and the generation of searchindexes corresponding with the stored snapshots, such as search indexes416.

The snapshots 414 may comprise a plurality of snapshots that include afull image snapshot of a plurality of electronic messages (or emails) ata first point in time and a second incremental snapshot of the pluralityof electronic messages at a second point in time subsequent to the firstpoint in time. The search indexes 416 may comprise a plurality of searchindexes, wherein each search index of the plurality of search indexes isassociated with one of the snapshots of the plurality of snapshots. Insome embodiments, a search index may be generated from a full imagesnapshot or from a portion of the full image snapshot. In the case thatthe full image snapshot comprises a plurality of electronic messages,the portion of the full image snapshot may be generated by extractingdata associated with a subject line for each of the electronic messages,a sender line or field associated with a sender for each of theelectronic messages, a receiver line or field associated with a receiverfor each of the electronic messages, a carbon copy line or fieldassociated with email addresses for receiving a copy of the electronicmessages, and a first number of lines within a message body for each ofthe electronic messages (e.g., the first three lines of text within eachof the electronic messages).

FIGS. 4C-4D depict a flowchart describing one embodiment of a processfor orchestrating the capturing and storing of snapshots of a set ofdata from a cloud-based service controlled by a customer to acloud-based storage service controlled by the customer. In oneembodiment, the process of FIGS. 4C-4D may be performed by a controller,such as the data backup and index generation controller 420 in FIG. 4B.In another embodiment, the process of FIGS. 4C-4D may be performed bycompute and storage resources, such as compute and storage resources 412in FIG. 4B.

In step 432, a secure connection is established with a customer'scloud-based storage or a customer's cloud-based storage account. Thesecure connection may be established with the customer's cloud-basedstorage by authenticating to the cloud-based storage account usingtoken-based authentication (e.g., via OAuth). The secure connection mayallow for a data backup and index generation controller, such as thedata backup and index generation controller 420 in FIG. 4B, to pushcomputer software or an application to be executed using computingresources within the customer's cloud-based storage account. In step434, compute and storage resources that are available within thecustomer's cloud-based storage for storing one or more snapshots of aset of data and for generating search indexes for the one or moresnapshots of the set of data are identified. The compute and storageresources may correspond with resources 412 in FIG. 4B. The set of datamay comprise a plurality of electronic messages. In one example, theplurality of electronic messages may comprise a current state of emailsassociated with a username or associated with an email application. Inanother example, the plurality of electronic messages may comprisenumerous email inboxes associated with a plurality of usernames. Inanother example, the plurality of electronic messages may correspondwith the states of a plurality of email applications used by a pluralityof different end users of the plurality of email applications.

In step 436, it is detected that a first snapshot of the one or moresnapshots of the set of data should be captured and stored within thecustomer's cloud-based storage. In one embodiment, it may be determinedthat the first snapshot should be captured and stored if it has beenlonger than a threshold period of time since the last snapshot of theset of data was captured and stored. The determination of whether tocapture and store the first snapshot may depend on data backup policiesfor the set of data. A backup policy may require that snapshots of theset of data be captured every hour or every 24 hours. In step 438,acquisition of a first set of data associated with the first snapshotfrom a cloud-based service in communication with the customer'scloud-based storage is directed or orchestrated. In one example, thedata backup and index generation controller 420 may direct the computeand storage resources 412 depicted in FIG. 4B to acquire the first setof data from the customer cloud service 402. The first set of data maycomprise a full image snapshot or an incremental snapshot (e.g., aforward incremental snapshot).

In step 440, the cloud-based storage is directed to store the firstsnapshot using the storage resources. In step 442, the cloud-basedstorage is directed to generate a first search index for the firstsnapshot using the compute resources and store the first search indexusing the storage resources. In this case, the data backup and indexgeneration controller 420 may direct the compute and storage resources412 depicted in FIG. 4B to store the first snapshot using the storageresources and to generate and store the first search index for the firstsnapshot using the storage resources. In step 444, it is detected that asecond snapshot of the one or more snapshots of the set of data shouldbe captured and stored within the customer's cloud-based storage. Thedetermination of whether to capture and store the second snapshot maydepend on the data backup policies for the set of data. In step 446,acquisition of a second set of data associated with the second snapshotfrom the cloud-based service in communication with the customer'scloud-based storage is directed or orchestrated. In step 448, thecloud-based storage is directed to store the second snapshot using thestorage resources.

In step 450, a change in the compute and storage resources that areavailable within the customer's cloud-based storage is detected. In oneembodiment, the change in the compute and storage resources may comprisean increase or a decrease in the amount of disk space available to thestorage resources. In another embodiment, the change in the compute andstorage resources may comprise an increase or decrease in the number ofprocessors for the compute resources. In step 452, the first searchindex is regenerated in response to detecting the change in the computeand storage resources. In one example, the first search index may beregenerated in order to reduce the size of the first search index inresponse to detecting that the amount of disk space available to thestorage resources has decreased or fallen below a threshold amount ofdisk space. In step 454, a maximum file size for a second search indexfor the second snapshot is determined. In one example, the maximum filesize for the second search index for the second snapshot may bedetermined based on the amount of available disk space within thestorage resources or the total amount of disk space for the storageresources. If the amount of available disk space within the storageresources, such as the amount of available disk space for the resources412 in FIG. 4B, is greater than a threshold amount of disk space (e.g.,is greater than 10 TB), then the maximum file size for the second searchindex may be set to a first file size (e.g., 2 GB); however, if theamount of available disk space within the storage resources is notgreater than the threshold amount of disk space, then the maximum filesize for the second search index may be set to a second file size lessthan the first file size (e.g., 100 MB). In step 456, the cloud-basedstorage account is directed to generate the second search index for thesecond snapshot using the compute resources and store the second searchindex using the storage resources. In one example, the second searchindex is generated such that a file size of the second search index isnot greater than the maximum file size. The file size of the secondsearch index may depend on the number of fields extracted from thesecond snapshot of the set of data to generate the second search index.The fields may comprise a subject line field, a sender field, and areceiver field for an electronic message.

FIG. 5A depicts one embodiment of point in time snapshots of a set ofdata and corresponding search indexes for the snapshots. The set of datamay comprise one or more electronic files associated with a real orvirtual machine or a portion of a real or virtual machine. The set ofdata may comprise one or more electronic files or a plurality ofelectronic messages and may include both data and metadata from the oneor more electronic files. The set of data may comprise an email mailboxfor a user or a plurality of email mailboxes for a plurality of users(e.g., the set of data may comprise a concatenation of ten thousandemail mailboxes). As depicted, the snapshot SP1 of the set of datacorresponding with point in time version T1 and snapshot SP4corresponding with point in time version T4 may comprise full imagesnapshots, while the snapshot SP2 corresponding with point in timeversion T2 and snapshot SP3 corresponding with point in time version T3may comprise incremental snapshots (e.g., forward incremental snapshotsthat derive from the snapshot SP1 that corresponds with the point intime version T1 of the set of data). The search indexes IN1-IN4 maycomprise hash-based indexes. The file sizes of the search indexesIN1-IN4 may be smaller than the file sizes for the snapshots SP1-SP4 asonly search keys and pointers may be stored. The search index IN1 maycomprise an index file for the snapshot SP1 that includes a plurality ofindex entries, wherein each index entry is associated with a search keyvalue and a pointer or mapping to a location within the snapshot SP1.The search index IN1 may include an inverted index (e.g., a word-levelinverted index) or an index data structure that stores a mapping fromidentified content (e.g., particular words) to locations within thesnapshot SP1.

FIG. 5B depicts the point in time snapshots of the set of data in FIG.5A and corresponding secondary layers for the snapshots. The secondarylayers SL1-SL4 may comprise portions or subsets of the data within thesnapshots SP1-SP4. In one example, the snapshot SP1 may comprise asnapshot of an email inbox and the corresponding secondary layer SL1 maycomprise only the portions of the snapshot SP1 that are related to thesubject, sender, and/or receiver fields for electronic messages withinthe email inbox. In this case, any attachments or text within the bodyof the electronic messages may have been extracted out or removed fromthe secondary layer SL1. The snapshots SP1-SP4 may be stored using afirst type of data storage (e.g., blob storage) while the secondarylayers SL1-SL4 are stored using a second type of data storage differentfrom the first type of data storage (e.g., block storage or file-basedstorage).

In some embodiments, the snapshot SP1 may comprise a snapshot of anemail mailbox and the corresponding secondary layer SL1 may comprise theportions of the snapshot SP1 that are related to the subject, sender,receiver, and date received fields for electronic messages within theemail mailbox and a dynamically adjustable number of lines of text or adynamically adjustable total number of text characters within themessage bodies of the electronic messages. The dynamically adjustablenumber of lines of text and/or the dynamically adjustable total numberof text characters within the message bodies may be adjusted over timedepending on the amount of available disk space for storing thesecondary layers SL1-SL4. The dynamically adjustable number of lines oftext and/or the dynamically adjustable total number of text characterswithin the message bodies may be increased or decreased depending onprior user searching behavior. For example, the dynamically adjustablenumber of lines of text within the electronic message bodies may beincreased if the user of the email mailbox has searched on snapshotswithin a particular date range more than a threshold number of times(e.g., has performed a keyword search on the snapshots SP1-SP4 more thantwice within the past week). The search indexes IN1-IN4 may be generatedfrom the secondary layers SL1-SL4 instead of being generated from thelarger snapshots SP1-SP4. The search indexes IN1-IN4 may be stored usingblock storage or file-based storage.

FIG. 5C depicts the snapshots, secondary layers, and search indexes ofFIG. 5B wherein the secondary layers SL1-SL4 have been reduced in size(e.g., their file sizes may have been cut in half). A secondary layermay be regenerated to include less information if the amount ofavailable disk space has fallen below a threshold amount of disk space(e.g., is less than 10 GBs of disk space), if the amount of availabledisk space has fallen below a threshold percentage of disk space (e.g.,is less than 10% of the total disk space), or if the user of the emailmailbox has not performed a search on the snapshots for at least athreshold period of time (e.g., the user of the email mailboxes has notperformed a search within the past week). In one example, the secondarylayer SL4 508 in FIG. 5B may comprise the subject, sender, receiver, anddate received fields for the electronic messages within the emailmailbox for the snapshot SP4 and include the first ten lines of textwithin the message bodies of the electronic messages, while thesecondary layer SL4 510 in FIG. 5C may comprise only the subject,sender, receiver, and date received fields for the electronic messageswithin the email mailbox for the snapshot SP4 and not include any linesof text within the message bodies of the electronic messages.

FIG. 5D depicts the snapshots, secondary layers, and search indexes ofFIG. 5B after secondary layers SL2-SL3 have been removed. In oneembodiment, if the amount of available disk space for storing secondarylayers is less than a threshold amount of disk space (e.g., is less than10 GBs of disk space), then one or more secondary layers may be deletedin order to free up disk space. The determination of which secondarylayers should be deleted first may depend on whether the correspondingsnapshots are full image snapshots or incremental snapshots. Thedetermination of which secondary layers should be deleted may depend onprior user search behavior with secondary layers corresponding withsnapshots that have not been searched for at least a threshold period oftime being deleted (e.g., secondary layers corresponding with snapshotsthat have not been searched within the past month may be deleted to freeup disk space).

FIG. 5E is a flowchart describing one embodiment of a process forgenerating and storing secondary layers corresponding with snapshots ofa set of data. In one embodiment, the process of FIG. 5E may beperformed by a controller, such as the data backup and index generationcontroller 420 in FIG. 4B or by compute and storage resources, such ascompute and storage resources 412 in FIG. 4B. In another embodiment, theprocess of FIG. 5E may be performed by a storage appliance, such asstorage appliance 140 in FIG. 1A.

In step 522, a set of fields for generating a secondary layer associatedwith a snapshot of a set of data is identified. The set of data maycomprise electronic messages and the set of fields may comprise asubject line field, a sender field, a receiver field, and a datereceived field for the electronic messages. In step 524, an amount ofavailable disk space for storing the secondary layer is determined. Instep 526, a data change rate for the snapshot relative to a priorsnapshot of the set of data is determined. In one example, the datachange rate may correspond with the number of data changes or the numberof changed data blocks between the snapshot and an earlier point in timesnapshot of the set of data. The earlier point in time snapshot of theset of data may comprise the previous snapshot of the set of data thatwas captured and stored prior to the snapshot. In step 528, it isdetected that the secondary layer should be generated and stored basedon the amount of available disk space and/or the data change rate. Inone example, if the amount of available disk space is at least athreshold amount of disk space (e.g., there is at least 50 GBs of diskspace remaining), then the secondary layer should be generated andstored. If the amount of available disk space is less than the thresholdamount of disk space, then the secondary layer should not be generated.In another example, if the data change rate is greater than a thresholdchange rate, then the secondary layer should be generated and stored;otherwise, if the data change rate is not greater than the thresholdchange rate, then the secondary layer should not be generated.

In step 530, the secondary layer is generated and stored using the setof fields and the snapshot of the set of data. The secondary layer maybe generated by extracting data associated with the set of fields fromthe snapshot of the set of data. In step 532, it is detected that theset of fields should be modified to comprise a second set of fieldsdifferent from the set of fields. In one example, the second set offields may include an additional field or comprise fewer fields than theset of fields. The second set of fields may comprise the set of fieldsminus a field for the body of an electronic message. The second set offields may specify a fewer number of lines of text within the body ofelectronic messages (e.g., to extract two lines of text) compared withthe set of fields (e.g., to extract up to twenty lines of text). In step534, the secondary layer is regenerated and stored using the second setof fields and the snapshot of the set of data. The secondary layer maybe regenerated by extracting data associated with the second set offields from the snapshot of the set of data.

In step 536, a search index for the snapshot of the set of data isgenerated and stored. The search index may include an inverted index oran index data structure that stores a mapping for identified content(e.g., words and numbers) within the snapshot to the correspondinglocations within the snapshot. In step 538, it is detected that anamount of available disk space for storing other secondary layers isless than a threshold disk space (e.g., is less than 10 GB). In step540, the secondary layer is deleted in response to detecting that theamount of available disk space for storing the other secondary layers isless than the threshold disk space. In some embodiments, if it isdetected that the amount of available disk space for storing the othersecondary layers is less than the threshold disk space, then thesecondary layers corresponding with snapshots that have not beensearched within a past threshold amount of time (e.g., that have notbeen searched for the past week) may be deleted.

FIG. 6A depicts one embodiment of a multi-layered approach for storing asnapshot of a set of data. The set of data may comprise a snapshot of avirtual machine, a snapshot of a real machine, a snapshot of a set ofelectronic files, or a snapshot of electronic messages within a user'semail mailbox. As depicted, an attachment 604 (e.g., comprising an emailattachment such as a word processing document or an image file) and atext block 602 (e.g., comprising a paragraph of text within the body ofan email message) have been identified and extracted from the set ofdata and stored within the shared space layer 610. The shared spacelayer 610 may be stored using block storage or file-based storage. Theshared space layer 610 may be stored using storage resources, such asresources 412 in FIG. 4B. The user specific layer 612 may correspondwith a first electronic message within a user's email mailbox and theuser specific layer 614 may correspond with a second electronic messagewithin the user's email mailbox. Both the first electronic message andthe second electronic message may include the same attachment 604 andthe first electronic message may include a text block corresponding withthe text block 602 stored within the shared space layer 610.

In one embodiment, both the user specific layer 612 and the userspecific layer 614 may correspond with electronic messages within afirst user's email mailbox. In another embodiment, the user specificlayer 612 may correspond with a first electronic message within a firstuser's email mailbox and the user specific layer 614 may correspond witha second electronic message within a second user's email mailbox. In oneexample, an electronic message may be sent to both the first user's andthe second user's email mailboxes (e.g., the electronic message may besent to email addresses associated with both the first user and thesecond user) that includes an attachment that is identical to theattachment 604 stored within the shared space layer 610. The userspecific layer 612 and the user specific layer 614 may be stored as twoseparate files using block storage or file-based storage. The userspecific layer 612 may include pointers to the text block 602 and theattachment 604 within the shared space layer 610. The user specificlayer 614 may include a pointer to the attachment 604. The pointerswithin the user specific layers allows for multiple user specific layersto reference the same attachment or text block stored within the sharedspace layer 610.

In some cases, text level deduplication in which a text block isidentified and stored within a shared space layer, such as text block602, may only be performed if an electronic message is sent to at leasta threshold number of email addresses (e.g., is sent to at least tenemail addresses). In some cases, deduplication of email attachments inwhich an attachment is identified and stored within a shared spacelayer, such as attachment 604, may only be performed if an electronicmessage is sent to at least a threshold number of email addresses (e.g.,is sent to at least two email addresses). It should be noted that anelectronic message originating from within an organization and sent toan email address within the organization may require that a largeattachment of the electronic message be stored twice (e.g., the largeattachment may reside in email mailboxes for both the sender and thereceiver of the electronic message).

FIG. 6B depicts one embodiment of a multi-layered approach fordeduplicating content in which an attachment 604 within the shared spacelayer 610 of FIG. 6A is referenced by a new user specific layer 616corresponding with a third electronic message. In this case, the thirdelectronic message may comprise a copy of the second electronic messagethat has been forwarded to a third user's email mailbox. Themulti-layered approach in which electronic messages across numerous useremail mailboxes are partitioned into user specific layers correspondingwith individual electronic messages with pointers into a shared spacelayer that is shared by the electronic messages allows for the efficientstorage and deduplication of content across the numerous user emailmailboxes.

In one embodiment, the state of the shared space layer 610 and the userspecific layers 612-614 depicted in FIG. 6A may correspond with a firstsnapshot of numerous user email mailboxes at a first point in time andthe state of the shared space layer 610 and the user specific layers612-616 depicted in FIG. 6B may correspond with a second snapshot of thenumerous user email mailboxes at a second point in time subsequent tothe first point in time.

FIG. 6C depicts one embodiment of the state of the shared space layer610 and the user specific layers 612-614 depicted in FIG. 6A in which arestore operation is performed to restore electronic messagescorresponding with the user specific layer 612 and the user specificlayer 614. As depicted, a first electronic message corresponding withthe user specific layer 612 may be restored as the user requestingrestoration of the first electronic message is authorized to access boththe text block 602 and the attachment 604 within the shared space layer610; however, a second electronic message corresponding with the userspecific layer 614 may not be fully restored as a user requestingrestoration of the second electronic message is not authorized to accessthe attachment 604 within the shared space layer 610. In this case, theability of the second electronic message to reference the attachment 604may be severed and a broken link 622 from the attachment 604 may preventthe contents of the attachment 604 from being pulled during restorationof the second electronic message.

In one embodiment, it may be detected that the attachment 604 includes arestricted keyword that matches one of a number of keywords associatedwith sensitive information and that the user does not have accesspermissions for data associated with the restricted keyword. In oneexample, the restricted keyword may correspond with a project codename,a particular person's name, or an identification number or usernameassociated with a particular person. In the case that the userrequesting restoration of an attachment or text block within a sharedspace layer does not have user access permissions to the attachment ortext block that contains the restricted keyword, the attachment or thetext block may be restored with the restricted keyword redacted from theattachment or the text block. In some cases, the attachment or the textblock may be restored with a new keyword in place of the restrictedkeyword. In one example, a mapping table may be used to substitute thenew keyword in place of the restricted keyword (e.g., substituting a newword for a restricted project codename).

In another embodiment, it may be detected that the attachment 604 isassociated with a hash value that corresponds with one of a number ofhash values associated with sensitive information. In one example, theattachment 604 may comprise an image or a slide deck and the hash valuemay be generated for the entire attachment 604 and then compared with alisting of hash values stored in a table of restricted hash values.

FIG. 6D depicts one embodiment of a secondary layer 622 generated from ashared space layer 610 and a search index 624. In one embodiment, thesearch index 624 may be generated from the secondary layer 622. Thesecondary layer 622 may comprise a subset of the data within the sharedspace layer 610 less than all of the data within the shared space layer610. In one example, the secondary layer 622 may comprise the first tenlines of the text block 602 or the first 100 characters within the textblock 602 and OCR'd text from the attachment 604. The secondary layer622 may be stored as a file with a file size that is substantiallysmaller in size than that of the shared space layer 610. In anotherembodiment, the search index 624 may be generated directly from theshared space layer 610.

In some embodiments, the number of lines extracted from the text block602 to generate the second layer 622 may be set or adjusted based on theamount of disk space available within data storage resources, such asresources 412 in FIG. 4B. In one example, if the amount of disk spaceavailable within the data storage resources is greater than a thresholdamount of disk space (e.g., is greater than 10 GB), then the number oflines extracted from the text block 602 may be set to a first number oflines (e.g., set to ten lines); however, if the amount of disk spaceavailable within the data storage resources is not greater than thethreshold amount of disk space, then the number of lines extracted fromthe text block 602 may be set to a second number of lines (e.g., set totwo lines) less than the first number of lines. In other embodiments, ifthe total amount of disk space available within the data storageresources falls below the threshold amount of disk space, then thesecondary layer 622 may be deleted to free up disk space.

FIGS. 6E-6F depict a flowchart describing one embodiment of a processfor deduplicating content using a shared space layer and one or moreuser specific layers that contain pointers into the shared space layer.In one embodiment, the process of FIGS. 6E-6F may be performed by acontroller, such as the data backup and index generation controller 420in FIG. 4B or by compute and storage resources, such as compute andstorage resources 412 in FIG. 4B. In another embodiment, the process ofFIGS. 6E-6F may be performed by a storage appliance, such as storageappliance 140 in FIG. 1A.

In step 632, an electronic message associated with a username isacquired. The electronic message may comprise one of a plurality ofelectronic messages received by an email address associated with theusername. In some cases, the plurality of electronic messages maycorrespond with numerous email messages within a user's email mailbox ata particular point in time. In other cases, the plurality of electronicmessages may correspond with numerous email messages across a pluralityof email mailboxes for a plurality of different users at the particularpoint in time. In step 634, an attachment is identified from theelectronic message. The attachment may comprise a text document, a wordprocessing document, a spreadsheet, an image, or an audio file. In step636, a text block is identified within the electronic message. The textblock may comprise a paragraph within a body of electronic message orone or more words within the body of electronic message.

In step 638, an aggregate file size for the attachment is determined. Inone example, the aggregate file size for the attachment may comprise thefile size for the attachment. In another example, the aggregate filesize for the attachment may comprise the file size for the attachmentmultiplied by the number of recipients of the electronic message. Inthis case, if the electronic message was sent to ten different emailaddresses, then the aggregate file size for the attachment may compriseten times the file size for the attachment. In step 640, an aggregatedata size for the text block is determined. In one example, theaggregate data size for the text block may comprise a file size forstoring the text block or an amount of disk space required to store thetext block. In another example, the aggregate data size for the textblock may comprise the data size for storing the text block multipliedby the number of recipients of the electronic message. In this case, ifelectronic message was sent to twenty different email addresses, thenthe aggregate data size for the text block may comprise twenty times thedata size for storing the text block.

In step 642, it is detected that the attachment should be stored withina shared space layer based on the aggregate file size for theattachment. In one example, if the aggregate file size for theattachment is greater than a threshold file size, then the attachmentshould be stored using the shared space layer. In step 644, it isdetected that the text block should be stored within the shared spacelayer based on the aggregate data size for the text block. In oneexample, if the aggregate data size for the text block is greater than athreshold data size, then the text block should be stored using theshared space layer. In step 646, the attachment is stored within theshared space layer. The attachment may be stored using block storage orfile-based storage. In step 648, a user specific layer is generated forthe electronic message. The user specific layer for the electronicmessage may include a pointer to the attachment within the shared spacelayer. As the attachment has been stored within the shared space layer,it may be referenced by other user specific layers corresponding withother electronic messages.

In step 650, the text block is stored within the shared space layer. Thetext block may be stored using block storage or file-based storage. Instep 652, the user specific layer for the electronic message is updatedwith a second pointer to the text block within the shared space layer.In this case, the user specific layer for the electronic message maycomprise data from the originally received electronic message with apointer to the attachment within the shared space layer and the secondpointer to the text block within the shared space layer.

In step 654, a second electronic message associated with a secondusername different from the username is acquired. The second usernamemay correspond with a second email address that is different from anemail address associated with the username. In step 656, it is detectedthat a second attachment from the second electronic message is identicalto the attachment stored within the shared space layer. It may bedetected that the second attachment is identical to the attachmentstored within the shared space layer by comparing one or more hashvalues generated from the second attachment and the attachment storedwithin the shared space layer. In step 658, a second user specific layerfor the second electronic message is updated or created with a thirdpointer to the attachment within the shared space layer. In oneembodiment, the electronic message may correspond with the user specificlayer 612 in FIG. 6A with a pointer to the attachment 604 within theshared space layer 610 and the second electronic message may correspondwith the user specific layer 614 in FIG. 6A with a second pointer to theattachment 604 within the shared space layer 610.

In step 660, it is detected that a second text block within the secondelectronic message is not identical to any text block stored within theshared space layer. In some cases, it may be detected that the secondtext block does not match any of the other text blocks stored within theshared space layer via direct data comparisons of the second text blockwith the other text blocks stored within shared space layer. In othercases, it may be detected that the second text block does not match anyof the other text blocks stored within the shared space layer if one ormore hash values generated from the second text block are not identicalto corresponding hash values generated from any of the other text blocksstored within the shared space layer. In step 662, the second text blockis stored within the shared space layer in response to detecting thatthe second text block within the second electronic message is notidentical to any of the text blocks stored within the shared spacelayer. In step 664, the second user specific layer for the secondelectronic message is updated with a fourth pointer to the second textblock within the shared space layer. The fourth pointer to the secondtext block may correspond with the pointer from the user specific layer612 in FIG. 6A to the text block 602 within the shared space layer 610of FIG. 6A.

FIG. 6G is a flowchart describing one embodiment of a process forselectively restoring content from a shared space layer that isreferenced by one or more user specific layers corresponding withindividual electronic messages. In one embodiment, the process of FIG.6G may be performed by a controller, such as the data backup and indexgeneration controller 420 in FIG. 4B or by compute and storageresources, such as compute and storage resources 412 in FIG. 4B. Inanother embodiment, the process of FIG. 6G may be performed by a storageappliance, such as storage appliance 140 in FIG. 1A.

In step 672, an instruction from a user to restore a snapshot of a setof electronic files is acquired. The user may be identified via ausername that is unique to the user. The set of electronic files maycorrespond with a plurality of electronic messages associated with asnapshot of an email mailbox associated with the username. In step 674,a user specific layer corresponding with a first electronic file of theset of electronic files is identified. The first electronic file maycorrespond with a first electronic message within the email mailbox. Instep 676, a first pointer to an attachment stored within a shared spacelayer is identified. The first pointer to the attachment may be locatedwithin the user specific layer corresponding with the first electronicfile. In step 678, a second pointer to a text block within the sharedspace layer is identified. The second pointer to the text block may belocated within the user specific layer corresponding with the firstelectronic file. In one example, the user specific layer may correspondwith the user specific layer 612 in FIG. 6C and the text block maycorrespond with the text block 602 within the shared space layer 610 ofFIG. 6C.

In step 680, it is detected that the attachment includes a firstkeyword. The first keyword may be identified from a list of keywordsassociated with sensitive information that requires authorized access inorder to view, access, search, or restore. The first keyword maycomprise a project codename, an email address, a personal identificationnumber, or a person's name. The list of keywords associated with thesensitive information may be stored in a lookup table that isperiodically updated. The lookup table may be stored using storageresources, such as the resources 412 in FIG. 4B. In step 682, it isdetected that restoration of the attachment is authorized for the user.In one example, the attachment may be authorized for the user becausethe attachment does not contain the first keyword. In another example,the attachment may be authorized for the user because the user isauthorized to receive attachments that contain the first keyword. Instep 684, it is detected that the text block includes a second keyworddifferent from the first keyword. The second keyword may be identifiedfrom the list of keywords associated with the sensitive information.

In step 686, it is detected that restoration of the text block is notauthorized for the user. In this case, it may be detected thatrestoration of the text block is not authorized for the user because theuser is not authorized to receive content that includes the secondkeyword. In step 688, the first electronic file is restored withoutoutputting the text block that includes the second keyword. In thiscase, as the user is not authorized to receive content that includes thesecond keyword, the second keyword may be omitted from the restoredfirst electronic file. In some cases, the first electronic file may berestored with a different word substituted for the second keyword. Analert or message may be outputted to the user if a keyword substitutionor omission has taken place during restoration of the first electronicfile.

In step 690, it is detected that restoration of the text block isauthorized for the user. Over time, the list of keywords associated withthe sensitive information may be updated to not include the secondkeyword or the user may be authorized to receive content that includesthe second keyword. In step 692, the first electronic file of the set ofelectronic files is restored with both the text block and theattachment. The restored first electronic file may be outputted from astorage appliance, such as storage appliance 140 in FIG. 1A, oroutputted from a cloud-based storage service, such as customer cloudstorage 404 in FIG. 4A.

FIG. 7A depicts one embodiment of two consecutive snapshots of a set ofelectronic messages and electronic messages that were a part of the setof electronic messages between the two consecutive snapshots but werenot captured by the either of the two consecutive snapshots. In oneembodiment, the set of electronic messages may correspond with emailmessages within a user's email mailbox. The user's email mailbox mayinclude an inbox (e.g., for received electronic messages), a deleteditems folder (e.g., for electronic messages that were deleted), a sentitems folder (e.g., for electronic messages that were sent to others),and a drafts folder (e.g., for temporarily saved electronic messagesthat have not yet been sent to others). In another embodiment, the setof electronic messages may correspond with email messages across aplurality of email mailboxes (e.g., covering the email mailboxes of twothousand employees of a company). As depicted, a first snapshot 702 ofthe two consecutive snapshots includes two email messages EM1 and EM2.The first snapshot may comprise a state of the set of electronicmessages at a first point in time T1. A second snapshot 706 of the twoconsecutive snapshots includes the two email messages EM1 and EM2. Thesecond snapshot may comprise a state of the set of electronic messagesat a second point in time T6 subsequent to the first point in time T1.In one example, the time difference between the first point in time andthe second point in time may comprise 24 hours or may comprise one hour.

Modifications to metadata associated with the two email messages EM1 andEM2 may have been made subsequent to the first point in time (e.g.,metadata associated with whether an email message has been read or apriority setting for the email message may have changed after the firstpoint in time and prior to the second point in time). At time T2 that issubsequent to time T1 and prior to time T6, a third email message EM3 isreceived and stored within the set of electronic messages. Uponreception of the third email message EM3, the third email message EM3may be stored within a buffer. In one example, the buffer may comprise amemory buffer within a storage resource, such as compute and storageresources 412 in FIG. 4B. In another example, the buffer may comprise amemory, such as memory 177 in FIG. 1A.

In some embodiments, inbound email messages and outbound email messagesmay be intercepted by a server that may forward the email messages orstore the email messages in the buffer. The third email message EM3 maybe added to an inbox of the user's email mailbox. At time T4 that isprior to time T6, the third email message EM3 is deleted from the set ofelectronic messages (e.g., due to the third email message EM3 beingdeleted from the inbox). At time T3 that is prior to time T6, a fourthemail message EM4 is sent from the user's email mailbox and may bestored within a sent items folder of the user's email mailbox. Upontransmission of the fourth email message EM4, the fourth email messageEM4 may be stored within the same buffer that is used for temporarilystoring the third email message EM3. At time T5 that is prior to timeT6, the fourth email message EM4 is deleted from the user's emailmailbox or is deleted from the sent items folder of the user's emailmailbox. As the email messages EM3 and EM4 were received and transmittedsubsequent to the first point in time corresponding with the firstsnapshot 702 and then were deleted prior to the second point in timecorresponding with the second snapshot 706, neither the first snapshot702 nor the second snapshot 706 includes the email messages EM3 and EM4.

When the second snapshot 706 is captured and stored, the bufferedelectronic messages stored within the buffer for temporarily storingelectronic messages that were transmitted and received subsequent to thefirst point in time may be compared with the electronic messages storedwithin the second snapshot 706. If a buffered electronic message is notstored within the second snapshot 706, then the buffered electronicmessage may be identified as an electronic message that was received ortransferred subsequent to the first snapshot 702 and was deleted priorto the second snapshot 706. As both the third email message EM3 and thefourth email message EM4 were buffered but did not appear within thesecond snapshot 706, the email messages EM3 and EM4 may be stored withina buffer snapshot 708. The buffer snapshot 708 may store a record of theelectronic messages that were received or transferred from a user'semail mailbox but were not captured within the two consecutive snapshots702 and 706 of the set of electronic messages.

In one embodiment, the set of electronic messages may include a firstset of email messages associated with a first user's email mailbox and asecond set of email messages associated with a second user's emailmailbox. The third email message EM3 may comprise an electronic messagethat was received at the first user's email mailbox and the fourth emailmessage EM4 may comprise an electronic message that was transferred orsent from the second user's email mailbox. After the buffer snapshot 708has been generated and stored, the contents of the buffer may be flushedand used to accumulate electronic messages that are received andtransferred subsequent to the second point in time.

In one embodiment, a list of emails that were received and/or sent froma user's email mailbox subsequent to a first snapshot of the user'semail mailbox may be compared with a list of emails that were capturedby a second snapshot of the user's email mailbox in order to identifyemail messages that were not included within either the first snapshotof the user's email mailbox or the second snapshot of the user's emailmailbox. In another embodiment, the contents of the buffer snapshot 708may be searched for restricted keywords associated with sensitiveinformation. The restricted keywords may be stored within a table or alist of restricted keywords. Upon detection that the contents of thebuffer snapshot 708 include a restricted keyword associated with thesensitive information, an alert may be generated and outputtedidentifying the electronic message within the buffer snapshot 708 thatincludes the restricted keyword.

In another embodiment, an electronic message stored within the buffermay be deleted and not captured within the buffer snapshot 708 if theelectronic message is less than a threshold data size (e.g., is lessthan 5 MB). In another embodiment, an electronic message within thebuffer may be deleted and not captured within the buffer snapshot 708 ifthe electronic message includes a restricted keyword. In someembodiments, an electronic message within the buffer may be captured andstored within the buffer snapshot 708 only if the electronic messageincludes a restricted keyword. In this case, an electronic messagewithin the buffer may be preserved within the buffer snapshot 708 onlyif the electronic message includes one or more restricted keywords. Inanother embodiment, an electronic message within the buffer may becaptured and stored within the buffer snapshot 708 only if theelectronic message includes a keyword that has been searched within athreshold period of time (e.g., an electronic message may be preservedif electronic message includes a keyword that is been searched withinthe past week).

FIG. 7B is a flowchart describing one embodiment of a process foridentifying electronic messages that were not captured by twoconsecutive snapshots of a set of electronic messages and generating abuffer snapshot for the missing electronic messages. The set ofelectronic messages may correspond with email messages within a user'semail mailbox. In one embodiment, the process of FIG. 7B may beperformed by a controller, such as the data backup and index generationcontroller 420 in FIG. 4B or by compute and storage resources, such ascompute and storage resources 412 in FIG. 4B. In another embodiment, theprocess of FIG. 7B may be performed by a storage appliance, such asstorage appliance 140 in FIG. 1A.

In step 722, a first snapshot of a set of electronic messages isacquired. The first snapshot may comprise a state of the set ofelectronic messages at a first point in time. The set of electronicmessages may correspond with email messages within one or more emailmailboxes. In step 724, it is detected that a first electronic messagewas received subsequent to the first point in time. In step 726, thefirst electronic message is buffered within a memory buffer. The memorybuffer may reside within a server that is configured to interceptelectronic messages that are received or transmitted from the one ormore email mailboxes. In step 728, it is detected that a secondelectronic message was transmitted subsequent to the first point intime. In step 730, the second electronic message is buffered within thememory buffer. In step 732, a second snapshot of the set of electronicmessages is acquired. The second snapshot may comprise a state of theset of electronic messages at a second point in time subsequent to thefirst point in time. The first snapshot and the second snapshot maycomprise two consecutive snapshots of the set of electronic messages. Instep 734, it is detected that the second snapshot of the set ofelectronic messages does not include either the first electronic messageor the second electronic message. In step 736, the first electronicmessage and the second electronic message are stored in a buffersnapshot in response to detecting that the second snapshot does notinclude either the first electronic message or the second electronicmessage. In some embodiments, the first electronic message may only bestored within the buffer snapshot if the first electronic messageincludes a restricted keyword, was sent from a particular email address,or was involved in a keyword search prior to the second point in time.

One embodiment of the disclosed technology includes establishing asecure connection with a cloud-based storage account, identifyingcompute and storage resources that are available within the cloud-basedstorage account, detecting that a first snapshot of a set of data shouldbe captured and stored within the cloud-based storage account, directingthe cloud-based storage account to acquire a first set of dataassociated with the first snapshot from a cloud-based service, directingthe cloud-based storage account to store the first snapshot using thecompute and storage resources, determining a first file size for a firstsearch index for the first snapshot based on an amount of available diskspace within the compute and storage resources, and directing thecloud-based storage account to generate and store the first search indexfor the first snapshot using the compute and storage resources such thatthe file size of the first search index is not greater than the firstfile size.

One embodiment of the disclosed technology includes acquiring aninstruction from a user to restore a snapshot of a set of electronicfiles, acquiring a user specific layer corresponding with a firstelectronic file of the set of electronic files, identifying a firstpointer to an attachment stored within a shared space layer using theuser specific layer for the first electronic file, identifying a secondpointer to a text block stored within the shared space layer using theuser specific layer for the first electronic file, detecting thatrestoration of the attachment is authorized for the user, detecting thatthe text block includes a restricted keyword, detecting that restorationof the text block is not authorized for the user subsequent to detectingthat the text block includes the restricted keyword, and restoring thefirst electronic file with the attachment and without outputting therestricted keyword.

The disclosed technology may be described in the context ofcomputer-executable instructions, such as software or program modules,being executed by a computer or processor. The computer-executableinstructions may comprise portions of computer program code, routines,programs, objects, software components, data structures, or other typesof computer-related structures that may be used to perform processesusing a computer. In some cases, hardware or combinations of hardwareand software may be substituted for software or used in place ofsoftware.

Computer program code used for implementing various operations oraspects of the disclosed technology may be developed using one or moreprogramming languages, including an object oriented programming languagesuch as Java or C++, a function programming language such as Scala, aprocedural programming language such as the “C” programming language orVisual Basic, or a dynamic programming language such as Python orJavaScript. In some cases, computer program code or machine-levelinstructions derived from the computer program code may execute entirelyon an end user's computer, partly on an end user's computer, partly onan end user's computer and partly on a remote computer, or entirely on aremote computer or server.

For purposes of this document, it should be noted that the dimensions ofthe various features depicted in the Figures may not necessarily bedrawn to scale.

For purposes of this document, reference in the specification to “anembodiment,” “one embodiment,” “some embodiments,” or “anotherembodiment” may be used to describe different embodiments and do notnecessarily refer to the same embodiment.

For purposes of this document, a connection may be a direct connectionor an indirect connection (e.g., via another part). In some cases, whenan element is referred to as being connected or coupled to anotherelement, the element may be directly connected to the other element orindirectly connected to the other element via intervening elements. Whenan element is referred to as being directly connected to anotherelement, then there are no intervening elements between the element andthe other element.

For purposes of this document, the term “based on” may be read as “basedat least in part on.”

For purposes of this document, without additional context, use ofnumerical terms such as a “first” object, a “second” object, and a“third” object may not imply an ordering of objects, but may instead beused for identification purposes to identify different objects.

For purposes of this document, the term “set” of objects may refer to a“set” of one or more of the objects.

Although the subject matter has been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the subject matter defined in the appended claims is notnecessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are disclosed asexample forms of implementing the claims.

What is claimed is:
 1. A method for operating a data management system,comprising: acquiring a first snapshot of a set of electronic messages,the first snapshot comprises a state of the set of electronic messagesat a first point in time; detecting that a first electronic message wasreceived subsequent to the first point in time; buffering the firstelectronic message using a memory buffer in response to detecting thatthe first electronic message was received subsequent to the first pointin time; acquiring a second snapshot of the set of electronic messagessubsequent to buffering the first electronic message using the memorybuffer, the second snapshot comprises a state of the set of electronicmessages at a second point in time subsequent to the first point intime; comparing electronic messages stored within the memory buffer withelectronic messages within the second snapshot of the set of electronicmessages; detecting that the second snapshot of the set of electronicmessages does not include the first electronic message based on thecomparison of the electronic messages stored within the memory bufferwith the electronic messages within the second snapshot of the set ofelectronic messages; storing the first electronic message within abuffer snapshot in response to detecting that the second snapshot of theset of electronic messages does not include the first electronicmessage; and deleting the first electronic message from the memorybuffer subsequent to storing the first electronic message within thebuffer snapshot.
 2. The method of claim 1, further comprising: detectingthat the first electronic message includes a restricted keyword; andremoving the first electronic message from the buffer snapshot inresponse to detecting that the first electronic message includes therestricted keyword.
 3. The method of claim 1, further comprising:detecting that the first electronic message includes a restrictedkeyword; and storing the first electronic message within the buffersnapshot in response to detecting that the first electronic messageincludes the restricted keyword and detecting that the second snapshotof the set of electronic messages does not include the first electronicmessage.
 4. The method of claim 1, further comprising: detecting thatthe first electronic message does not include a restricted keyword; andstoring the first electronic message within the buffer snapshot inresponse to detecting that the first electronic message does not includethe restricted keyword.
 5. The method of claim 1, further comprising:detecting that the first electronic message has been searched within apast threshold period of time; and storing the first electronic messagewithin the buffer snapshot in response to detecting that the firstelectronic message has been searched within the past threshold period oftime.
 6. The method of claim 1, wherein: the detecting that the firstelectronic message was received subsequent to the first point in timeincludes intercepting the first electronic message as an inbound emailmessage.
 7. The method of claim 1; further comprising: detecting that asecond electronic message was transmitted subsequent to the first pointin time; buffering the second electronic message using the memorybuffer; detecting that the second snapshot of the set of electronicmessages does not include the first electronic message or the secondelectronic message; storing the first electronic message in the buffersnapshot in response to detecting that the second snapshot does notinclude the first electronic message; and storing the second electronicmessage in the buffer snapshot in response to detecting that the secondsnapshot does not include the second electronic message.
 8. The methodof claim 1, wherein: the buffering the first electronic messagecomprises buffering the first electronic message within a cloud-basedstorage account.
 9. The method of claim 1, wherein: the set ofelectronic messages includes a first set of email messages associatedwith a first user's email mailbox and a second set of email messagesassociated with a second user's email mailbox.
 10. The method of claim1, wherein: the set of electronic messages corresponds with emailmessages across a plurality of email mailboxes; and the time differencebetween the first point in time and the second point in time comprisesan hour.
 11. A data management system, comprising: a memory buffer; andone or more processors in communication with the memory bufferconfigured to acquire a first snapshot of a set of electronic messages,the first snapshot comprises a state of the set of electronic messagesat a first point in time, the one or more processors configured todetect that a first electronic message was received subsequent to thefirst point in time and write the first electronic message to the memorybuffer, the one or more processors configured to acquire a secondsnapshot of the set of electronic messages subsequent to writing thefirst electronic message to the memory buffer, the second snapshotcomprises a state of the set of electronic messages at a second point intime subsequent to the first point in time, the one or more processorsconfigured to compare electronic messages stored within the memorybuffer with electronic messages within the second snapshot of the set ofelectronic messages, the one or more processors configured to detectthat the second snapshot of the set of electronic messages does notinclude the first electronic message based on the comparison of theelectronic messages stored within the memory buffer with the electronicmessages within the second snapshot of the set of electronic messages,the one or more processors configured to store the first electronicmessage within a buffer snapshot in response to detection that thesecond snapshot of the set of electronic messages does not include thefirst electronic message and delete the first electronic message fromthe memory buffer subsequent to the first electronic message beingstored within the buffer snapshot.
 12. The data management system ofclaim 11, wherein: the one or more processors configured to detect thatthe first electronic message includes a restricted keyword and removethe first electronic message from the buffer snapshot in response todetection that the first electronic message includes the restrictedkeyword.
 13. The data management system of claim 11, wherein: the one ormore processors configured to detect that the first electronic messagedoes not include a restricted keyword and remove the first electronicmessage from the buffer snapshot in response to detection that the firstelectronic message does not include the restricted keyword.
 14. The datamanagement system of claim 11, wherein: the one or more processorsconfigured to detect that the first electronic message has been searchedwithin a past threshold period of time and store the first electronicmessage within the buffer snapshot in response to detection that thefirst electronic message has been searched within the past thresholdperiod of time and detection that the second snapshot of the set ofelectronic messages does not include the first electronic message. 15.The data management system of claim 11, wherein: the one or moreprocessors configured to intercept the first electronic message as aninbound email message.
 16. The data management system of claim 11,wherein: the one or more processors configured to detect that a secondelectronic message was transmitted subsequent to the first point in timeand write the second electronic message to the memory buffer, the one ormore processors configured to detect that the second snapshot of the setof electronic messages does not include the first electronic message orthe second electronic message, the one or more processors configured tostore the first electronic message and the second electronic message inthe buffer snapshot in response to detection that the second snapshotdoes not include either the first electronic message or the secondelectronic message.
 17. The data management system of claim 11, wherein:the buffer snapshot is stored within a cloud-based data storage account;and the memory buffer comprises a volatile memory buffer.
 18. The datamanagement system of claim 11, wherein: the set of electronic messagesincludes a first set of email messages associated with a first user'semail mailbox and a second set of email messages associated with asecond user's email mailbox.
 19. The data management system of claim 11,wherein: the set of electronic messages corresponds with a plurality ofemail messages across a plurality of email mailboxes.
 20. One or morestorage devices containing processor readable code for programming oneor more processors to perform a method for operating a data managementsystem, the processor readable code comprising: processor readable codeconfigured to acquire a first snapshot of a set of electronic messages,the first snapshot comprises a state of the set of electronic messagesat a first point in time; processor readable code configured to detectthat a first electronic message was received subsequent to the firstpoint in time; processor readable code configured to buffer the firstelectronic message using a memory buffer in response to detection thatthe first electronic message was received subsequent to the first pointin time; processor readable code configured to acquire a second snapshotof the set of electronic messages subsequent to buffering the firstelectronic message using the memory buffer, the second snapshotcomprises a state of the set of electronic messages at a second point intime subsequent to the first point in time; processor readable codeconfigured to compare electronic messages stored within the memorybuffer with electronic messages within the second snapshot of the set ofelectronic messages; processor readable code configured to detect thatthe second snapshot of the set of electronic messages does not includethe first electronic message based on the comparison of the electronicmessages stored within the memory buffer with the electronic messageswithin the second snapshot of the set of electronic messages; processorreadable code configured to store the first electronic message within abuffer snapshot in response to detection that the second snapshot of theset of electronic messages does not include the first electronicmessage; and processor readable code configured to delete the firstelectronic message from the memory buffer subsequent to storing thefirst electronic message within the buffer snapshot.